- hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - vfs: use READ_ONCE() to access ->i_link (Jay Shin) [RHEL-141790] - fold generic_readlink() into its only caller (Jay Shin) [RHEL-141790] - fs/proc: fix uaf in proc_readdir_de() (Pavel Reichl) [RHEL-137093] {CVE-2025-40271} - Backport 'create an empty changelog file when changing its name' (Alexandra Hájková) - mptcp: fix race condition in mptcp_schedule_work() (Paolo Abeni) [RHEL-134443] {CVE-2025-40258} - mptcp: use mptcp_schedule_work instead of open-coding it (Paolo Abeni) [RHEL-134443] - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - tcp: minor optimization in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Kamal Heib) [RHEL-134347] {CVE-2025-38022} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - Bluetooth: hci_event: call disconnect callback before deleting conn (CKI Backport Bot) [RHEL-137039] {CVE-2023-53673} - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CKI Backport Bot) [RHEL-134423] {CVE-2025-40277} - xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 (John J Coleman) [RHEL-111354] - xen: Fix x86 sched_clock() interface for xen (John J Coleman) [RHEL-111354] - x86/xen/time: Output xen sched_clock time from 0 (John J Coleman) [RHEL-111354] - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Olga Kornievskaia) [RHEL-132819] - vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139273] {CVE-2025-40248} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ignore ndlp rport mismatch in dev_loss_tmo callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Modify handling of ADISC based on ndlp state and RPI registration (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Delete NLP_TARGET_REMOVE flag due to obsolete usage (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo callback (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Check devloss callbk done flag for potential stale NDLP ptrs (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kref imbalance on fabric ndlps from dev_loss_tmo handler (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Update PRLO handling in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Add condition to delete ndlp object after sending BLS_RJT to an ABTS (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove NLP_RCV_PLOGI early return during RSCN processing for ndlps (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Allow lpfc_plogi_confirm_nport() logic to execute for Fabric nodes (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix list_entry null check warning in lpfc_cmpl_els_plogi() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix possible file string name overflow when updating firmware (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Validate ELS LS_ACC completion payload (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove extra ndlp kref decrement in FLOGI cmpl for loop topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Revise NPIV ELS unsol rcv cmpl logic to drop ndlp based on nlp_state (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix double free in lpfc_cmpl_els_logo_acc() caused by lpfc_nlp_not_used() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Move scsi_host_template outside dynamically allocated/freed phba (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fill in missing ndlp kref puts in error paths (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login (Ewan D. Milne) [RHEL-32324] - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301} - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933} - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051} - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449] - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096} - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - vfs: use READ_ONCE() to access ->i_link (Jay Shin) [RHEL-141790] - fold generic_readlink() into its only caller (Jay Shin) [RHEL-141790] - fs/proc: fix uaf in proc_readdir_de() (Pavel Reichl) [RHEL-137093] {CVE-2025-40271} - Backport 'create an empty changelog file when changing its name' (Alexandra Hájková) - mptcp: fix race condition in mptcp_schedule_work() (Paolo Abeni) [RHEL-134443] {CVE-2025-40258} - mptcp: use mptcp_schedule_work instead of open-coding it (Paolo Abeni) [RHEL-134443] - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - tcp: minor optimization in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Kamal Heib) [RHEL-134347] {CVE-2025-38022} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - vfs: use READ_ONCE() to access ->i_link (Jay Shin) [RHEL-141790] - fold generic_readlink() into its only caller (Jay Shin) [RHEL-141790] - fs/proc: fix uaf in proc_readdir_de() (Pavel Reichl) [RHEL-137093] {CVE-2025-40271} - Backport 'create an empty changelog file when changing its name' (Alexandra Hájková) - mptcp: fix race condition in mptcp_schedule_work() (Paolo Abeni) [RHEL-134443] {CVE-2025-40258} - mptcp: use mptcp_schedule_work instead of open-coding it (Paolo Abeni) [RHEL-134443] - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - tcp: minor optimization in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Kamal Heib) [RHEL-134347] {CVE-2025-38022} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - autofs: use wake_up() instead of wake_up_interruptible(() (Ian Kent) [RHEL-143685] - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Ian Kent) [RHEL-143685] {CVE-2023-54134} - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141709] - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-136693] - audit: merge loops in __audit_inode_child() (Ricardo Robaina) [RHEL-140442] - bridge: mcast: Fix use-after-free during router port configuration (Mohammad Heib) [RHEL-138422] {CVE-2025-38248} - net/sched: Enforce that teql can only be used as root qdisc (CKI Backport Bot) [RHEL-146992] {CVE-2026-23074} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Marc Milgram) [RHEL-137838] {CVE-2025-38129} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143189] {CVE-2025-68800} - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126886] {CVE-2025-40064} - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147261] {CVE-2026-23097} - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-134673] - autofs: use wake_up() instead of wake_up_interruptible(() (Ian Kent) [RHEL-143685] - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Ian Kent) [RHEL-143685] {CVE-2023-54134} - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141709] - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-136693] - audit: merge loops in __audit_inode_child() (Ricardo Robaina) [RHEL-140442] - bridge: mcast: Fix use-after-free during router port configuration (Mohammad Heib) [RHEL-138422] {CVE-2025-38248} - net/sched: Enforce that teql can only be used as root qdisc (CKI Backport Bot) [RHEL-146992] {CVE-2026-23074} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Marc Milgram) [RHEL-137838] {CVE-2025-38129} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143189] {CVE-2025-68800} - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126886] {CVE-2025-40064} - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - macvlan: fix possible UAF in macvlan_forward_source() (Hangbin Liu) [RHEL-144120] {CVE-2026-23001} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-131922] - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount (Jocelyn Falempe) [RHEL-148636] - audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd references (Waiman Long) [RHEL-146026] - fs: Add a pool of extra fs->pwd references to fs_struct (Waiman Long) [RHEL-146026] - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143535] {CVE-2025-71085} - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147261] {CVE-2026-23097} - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-134673] - autofs: use wake_up() instead of wake_up_interruptible(() (Ian Kent) [RHEL-143685] - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Ian Kent) [RHEL-143685] {CVE-2023-54134} - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141709] - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-136693] - audit: merge loops in __audit_inode_child() (Ricardo Robaina) [RHEL-140442] - bridge: mcast: Fix use-after-free during router port configuration (Mohammad Heib) [RHEL-138422] {CVE-2025-38248} - net/sched: Enforce that teql can only be used as root qdisc (CKI Backport Bot) [RHEL-146992] {CVE-2026-23074} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Marc Milgram) [RHEL-137838] {CVE-2025-38129} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143189] {CVE-2025-68800} - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126886] {CVE-2025-40064} - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - x86/microcode/AMD: Revert "Backport AMD microcode commits for better microcode loading support" (Waiman Long) [RHEL-155860] - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150398] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150398] - tcp: fix forever orphan socket caused by tcp_abort (Paolo Abeni) [RHEL-146187] - xfs: fix minimum agno handling for xfs alloc modes in RHEL8 (Brian Foster) [RHEL-102464] - xfs: fix uninitialized use of flags variable in xfs_alloc_vextent() (Brian Foster) [RHEL-102464] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82523] - tcp: use this_cpu_read(*X) instead of *this_cpu_ptr(X) (Davide Caratti) [RHEL-82523] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150221] - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150221] {CVE-2026-23209} - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) [RHEL-96016] - s390/kexec: Emit an error message when cmdline is too long (Mete Durlu) [RHEL-144946] - s390/boot: Fix kernel size in bootparm area (Mete Durlu) [RHEL-144946] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-137123] - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-151614] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove useless transaction in evict_linked_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-151614] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-151614] - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146419] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146419] {CVE-2025-38323} - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136288] - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136288] - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136288] - scsi: st: Tighten the page format heuristics with MODE SELECT (John Meneghini) [RHEL-136288] - scsi: st: ERASE does not change tape location (John Meneghini) [RHEL-136288] - scsi: st: Fix array overflow in st_setup() (John Meneghini) [RHEL-136288] - scsi: st: Add sysfs file position_lost_in_reset (John Meneghini) [RHEL-136288] - scsi: st: Modify st.c to use the new scsi_error counters (John Meneghini) [RHEL-136288] - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (John Meneghini) [RHEL-136288] - scsi: st: Restore some drive settings after reset (John Meneghini) [RHEL-136288] - scsi: st: Fix input/output error on empty drive reset (John Meneghini) [RHEL-136288] - smb: client: handle lack of IPC in dfs_cache_refresh() (Paulo Alcantara) [RHEL-138235] - smb: client: allow parsing zero-length AV pairs (Paulo Alcantara) [RHEL-138235] - cifs: reduce warning log level for server not advertising interfaces (Paulo Alcantara) [RHEL-138235] - smb: client: Fix match_session bug preventing session reuse (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of kstrdup() in get_ses_refpath() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy when tree connecting to DFS interlink targets (Paulo Alcantara) [RHEL-138235] - smb: client: don't trust DFSREF_STORAGE_SERVER bit (Paulo Alcantara) [RHEL-138235] - smb: client: don't check for @leaf_fullpath in match_server() (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of TCP_Server_Info::refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: don't retry DFS targets on server shutdown (Paulo Alcantara) [RHEL-138235] - smb: client: fix return value of parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: optimize referral walk on failed link targets (Paulo Alcantara) [RHEL-138235] - smb: client: provide dns_resolve_{unc,name} helpers (Paulo Alcantara) [RHEL-138235] - smb: client: parse DNS domain name from domain= option (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS mount against old servers with NTLMSSP (Paulo Alcantara) [RHEL-138235] - smb: client: parse av pair type 4 in CHALLENGE_MESSAGE (Paulo Alcantara) [RHEL-138235] - smb: client: introduce av_for_each_entry() helper (Paulo Alcantara) [RHEL-138235] - smb: client: fix double free of TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-138235] {CVE-2025-21673} - smb: client: fix potential race in cifs_put_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy message when mounting shares (Paulo Alcantara) [RHEL-138235] - smb: client: don't try following DFS links in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow reconnect when sending ioctl (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of @nlsc param in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow more DFS referrals to be cached (Paulo Alcantara) [RHEL-138235] - smb: client: propagate error from cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS failover in multiuser mounts (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS interlink failover (Paulo Alcantara) [RHEL-138235] - smb: client: improve purging of cached referrals (Paulo Alcantara) [RHEL-138235] - smb: client: avoid unnecessary reconnects when refreshing referrals (Paulo Alcantara) [RHEL-138235] - smb: client: serialise cifs_construct_tcon() with cifs_mount_mutex (Paulo Alcantara) [RHEL-138235] - smb: client: handle DFS tcons in cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: refresh referral without acquiring refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: guarantee refcounted children from parent session (Paulo Alcantara) [RHEL-138235] {CVE-2024-35869} - smb: client: set correct id, uid and cruid for multiuser automounts (Paulo Alcantara) [RHEL-138235] {CVE-2024-26822} - cifs: change tcon status when need_reconnect is set on it (Paulo Alcantara) [RHEL-138235] - smb: client: fix potential NULL deref in parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: fix mount when dns_resolver key is not available (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs code dep in namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs naming in automount code (Paulo Alcantara) [RHEL-138235] - smb: client: rename cifs_dfs_ref.c to namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: ensure to try all targets when finding nested links (Paulo Alcantara) [RHEL-138235] - smb: client: introduce DFS_CACHE_TGT_LIST() (Paulo Alcantara) [RHEL-138235] - smb: client: fix null auth (Paulo Alcantara) [RHEL-138235] - smb: client: fix dfs link mount against w2k8 (Paulo Alcantara) [RHEL-138235] - cifs: fix charset issue in reconnection (Paulo Alcantara) [RHEL-138235] - smb: client: fix missed ses refcounting (Paulo Alcantara) [RHEL-138235] {CVE-2023-54076} - fs/nls: make load_nls() take a const parameter (Paulo Alcantara) [RHEL-138235] - smb: client: remove redundant pointer 'server' (Paulo Alcantara) [RHEL-138235] - smb: client: improve DFS mount check (Paulo Alcantara) [RHEL-138235] - smb: client: fix shared DFS root mounts with different prefixes (Paulo Alcantara) [RHEL-138235] - smb: client: fix parsing of source mount option (Paulo Alcantara) [RHEL-138235] - smb: client: fix warning in cifs_match_super() (Paulo Alcantara) [RHEL-138235] - cifs: fix max_credits implementation (Paulo Alcantara) [RHEL-138235] - cifs: fix sockaddr comparison in iface_cmp (Paulo Alcantara) [RHEL-138235] - cifs: fix status checks in cifs_tree_connect (Paulo Alcantara) [RHEL-138235] - cifs: fix smb1 mount regression (Paulo Alcantara) [RHEL-138235] - cifs: fix sharing of DFS connections (Paulo Alcantara) [RHEL-138235] - cifs: avoid potential races when handling multiple dfs tcons (Paulo Alcantara) [RHEL-138235] - cifs: protect access of TCP_Server_Info::{origin,leaf}_fullpath (Paulo Alcantara) [RHEL-138235] - cifs: avoid dup prefix path in dfs_get_automount_devname() (Paulo Alcantara) [RHEL-138235] - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL (Paulo Alcantara) [RHEL-138235] {CVE-2023-53246} - smb3: fix unusable share after force unmount failure (Paulo Alcantara) [RHEL-138235] - cifs: check only tcon status on tcon related functions (Paulo Alcantara) [RHEL-138235] - cifs: return DFS root session id in DebugData (Paulo Alcantara) [RHEL-138235] - cifs: fix use-after-free bug in refresh_cache_worker() (Paulo Alcantara) [RHEL-138235] {CVE-2023-53052} - cifs: set DFS root session in cifs_get_smb_ses() (Paulo Alcantara) [RHEL-138235] - cifs: remove unused function (Paulo Alcantara) [RHEL-138235] - cifs: remove duplicate code in __refresh_tcon() (Paulo Alcantara) [RHEL-138235] - cifs: remove redundant assignment to the variable match (Paulo Alcantara) [RHEL-138235] - cifs: use origin fullpath for automounts (Paulo Alcantara) [RHEL-138235] - cifs: fix source pathname comparison of dfs supers (Paulo Alcantara) [RHEL-138235] - cifs: fix confusing debug message (Paulo Alcantara) [RHEL-138235] - cifs: don't block in dfs_cache_noreq_update_tgthint() (Paulo Alcantara) [RHEL-138235] - cifs: refresh root referrals (Paulo Alcantara) [RHEL-138235] - cifs: fix refresh of cached referrals (Paulo Alcantara) [RHEL-138235] - cifs: share dfs connections and supers (Paulo Alcantara) [RHEL-138235] - cifs: split out ses and tcon retrieval from mount_get_conns() (Paulo Alcantara) [RHEL-138235] - cifs: set resolved ip in sockaddr (Paulo Alcantara) [RHEL-138235] - cifs: remove unused smb3_fs_context::mount_options (Paulo Alcantara) [RHEL-138235] - cifs: get rid of mount options string parsing (Paulo Alcantara) [RHEL-138235] - cifs: use fs_context for automounts (Paulo Alcantara) [RHEL-138235] - cifs: remove various function description warnings (Paulo Alcantara) [RHEL-138235] - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Select which microcode patch to load (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add more known models to entry sign checking (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Limit Entrysign signature checking to known generations (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use sha256() instead of init/update/final (Waiman Long) [RHEL-132479] - x86/microcode: Fix Entrysign revision check for Zen1/Naples (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Handle the case of no BIOS microcode (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add some forgotten models to the SHA check (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Load only SHA256-checksummed patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add get_patch_level() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Merge early_apply_microcode() into its single callsite (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Have __apply_microcode_amd() return bool (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Flush patch buffer mapping after application (Waiman Long) [RHEL-132479] - x86/mm: Carve out INVLPG inline asm for use by others (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Split load_microcode_amd() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Pay attention to the stepping dynamically (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix a -Wsometimes-uninitialized clang false positive (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use the family,model,stepping encoded in the patch ID (Waiman Long) [RHEL-132479] - x86/microcode/amd: Cache builtin microcode too (Waiman Long) [RHEL-132479] - x86/microcode/amd: Use correct per CPU ucode_cpu_info (Waiman Long) [RHEL-132479] - x86/microcode/amd: Remove X86_32 specific code in early_apply_microcode() & get_builtin_microcode() (Waiman Long) [RHEL-132479] - x86/microcode: Move core specific defines to local header (Waiman Long) [RHEL-132479] - x86/microcode/intel: Rename get_datasize() since its used externally (Waiman Long) [RHEL-132479] - x86/microcode: Make reload_early_microcode() static (Waiman Long) [RHEL-132479] - x86/microcode: Include vendor headers into microcode.h (Waiman Long) [RHEL-132479] - x86/microcode/intel: Move microcode functions out of cpu/intel.c (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Get rid of __find_equiv_id() (Waiman Long) [RHEL-132479] - x86/microcode: Add explicit CPU vendor dependency (Waiman Long) [RHEL-132479] - macvlan: fix possible UAF in macvlan_forward_source() (Hangbin Liu) [RHEL-144120] {CVE-2026-23001} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-131922] - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount (Jocelyn Falempe) [RHEL-148636] - audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd references (Waiman Long) [RHEL-146026] - fs: Add a pool of extra fs->pwd references to fs_struct (Waiman Long) [RHEL-146026] - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143535] {CVE-2025-71085} - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147261] {CVE-2026-23097} - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-134673] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930] - NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242] - pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242] - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242] - NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242] - NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242] - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242] - SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242] - NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242] - SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242] - SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242] - SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242] - SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242] - NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242] - NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419] - nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419] - pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419] - NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419] - NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419] - NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419] - NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419] - NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419] - NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419] - NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419] - NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419] - NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419] - nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419] - nfs: always check dreq->error after a commit (Mike Snitzer) [RHEL-156419] - nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419] - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231} - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942] - x86/microcode/AMD: Revert "Backport AMD microcode commits for better microcode loading support" (Waiman Long) [RHEL-155860] - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150398] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150398] - tcp: fix forever orphan socket caused by tcp_abort (Paolo Abeni) [RHEL-146187] - xfs: fix minimum agno handling for xfs alloc modes in RHEL8 (Brian Foster) [RHEL-102464] - xfs: fix uninitialized use of flags variable in xfs_alloc_vextent() (Brian Foster) [RHEL-102464] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82523] - tcp: use this_cpu_read(*X) instead of *this_cpu_ptr(X) (Davide Caratti) [RHEL-82523] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150221] - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150221] {CVE-2026-23209} - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) [RHEL-96016] - s390/kexec: Emit an error message when cmdline is too long (Mete Durlu) [RHEL-144946] - s390/boot: Fix kernel size in bootparm area (Mete Durlu) [RHEL-144946] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-137123] - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-151614] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove useless transaction in evict_linked_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-151614] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-151614] - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146419] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146419] {CVE-2025-38323} - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136288] - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136288] - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136288] - scsi: st: Tighten the page format heuristics with MODE SELECT (John Meneghini) [RHEL-136288] - scsi: st: ERASE does not change tape location (John Meneghini) [RHEL-136288] - scsi: st: Fix array overflow in st_setup() (John Meneghini) [RHEL-136288] - scsi: st: Add sysfs file position_lost_in_reset (John Meneghini) [RHEL-136288] - scsi: st: Modify st.c to use the new scsi_error counters (John Meneghini) [RHEL-136288] - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (John Meneghini) [RHEL-136288] - scsi: st: Restore some drive settings after reset (John Meneghini) [RHEL-136288] - scsi: st: Fix input/output error on empty drive reset (John Meneghini) [RHEL-136288] - smb: client: handle lack of IPC in dfs_cache_refresh() (Paulo Alcantara) [RHEL-138235] - smb: client: allow parsing zero-length AV pairs (Paulo Alcantara) [RHEL-138235] - cifs: reduce warning log level for server not advertising interfaces (Paulo Alcantara) [RHEL-138235] - smb: client: Fix match_session bug preventing session reuse (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of kstrdup() in get_ses_refpath() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy when tree connecting to DFS interlink targets (Paulo Alcantara) [RHEL-138235] - smb: client: don't trust DFSREF_STORAGE_SERVER bit (Paulo Alcantara) [RHEL-138235] - smb: client: don't check for @leaf_fullpath in match_server() (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of TCP_Server_Info::refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: don't retry DFS targets on server shutdown (Paulo Alcantara) [RHEL-138235] - smb: client: fix return value of parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: optimize referral walk on failed link targets (Paulo Alcantara) [RHEL-138235] - smb: client: provide dns_resolve_{unc,name} helpers (Paulo Alcantara) [RHEL-138235] - smb: client: parse DNS domain name from domain= option (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS mount against old servers with NTLMSSP (Paulo Alcantara) [RHEL-138235] - smb: client: parse av pair type 4 in CHALLENGE_MESSAGE (Paulo Alcantara) [RHEL-138235] - smb: client: introduce av_for_each_entry() helper (Paulo Alcantara) [RHEL-138235] - smb: client: fix double free of TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-138235] {CVE-2025-21673} - smb: client: fix potential race in cifs_put_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy message when mounting shares (Paulo Alcantara) [RHEL-138235] - smb: client: don't try following DFS links in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow reconnect when sending ioctl (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of @nlsc param in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow more DFS referrals to be cached (Paulo Alcantara) [RHEL-138235] - smb: client: propagate error from cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS failover in multiuser mounts (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS interlink failover (Paulo Alcantara) [RHEL-138235] - smb: client: improve purging of cached referrals (Paulo Alcantara) [RHEL-138235] - smb: client: avoid unnecessary reconnects when refreshing referrals (Paulo Alcantara) [RHEL-138235] - smb: client: serialise cifs_construct_tcon() with cifs_mount_mutex (Paulo Alcantara) [RHEL-138235] - smb: client: handle DFS tcons in cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: refresh referral without acquiring refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: guarantee refcounted children from parent session (Paulo Alcantara) [RHEL-138235] {CVE-2024-35869} - smb: client: set correct id, uid and cruid for multiuser automounts (Paulo Alcantara) [RHEL-138235] {CVE-2024-26822} - cifs: change tcon status when need_reconnect is set on it (Paulo Alcantara) [RHEL-138235] - smb: client: fix potential NULL deref in parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: fix mount when dns_resolver key is not available (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs code dep in namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs naming in automount code (Paulo Alcantara) [RHEL-138235] - smb: client: rename cifs_dfs_ref.c to namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: ensure to try all targets when finding nested links (Paulo Alcantara) [RHEL-138235] - smb: client: introduce DFS_CACHE_TGT_LIST() (Paulo Alcantara) [RHEL-138235] - smb: client: fix null auth (Paulo Alcantara) [RHEL-138235] - smb: client: fix dfs link mount against w2k8 (Paulo Alcantara) [RHEL-138235] - cifs: fix charset issue in reconnection (Paulo Alcantara) [RHEL-138235] - smb: client: fix missed ses refcounting (Paulo Alcantara) [RHEL-138235] {CVE-2023-54076} - fs/nls: make load_nls() take a const parameter (Paulo Alcantara) [RHEL-138235] - smb: client: remove redundant pointer 'server' (Paulo Alcantara) [RHEL-138235] - smb: client: improve DFS mount check (Paulo Alcantara) [RHEL-138235] - smb: client: fix shared DFS root mounts with different prefixes (Paulo Alcantara) [RHEL-138235] - smb: client: fix parsing of source mount option (Paulo Alcantara) [RHEL-138235] - smb: client: fix warning in cifs_match_super() (Paulo Alcantara) [RHEL-138235] - cifs: fix max_credits implementation (Paulo Alcantara) [RHEL-138235] - cifs: fix sockaddr comparison in iface_cmp (Paulo Alcantara) [RHEL-138235] - cifs: fix status checks in cifs_tree_connect (Paulo Alcantara) [RHEL-138235] - cifs: fix smb1 mount regression (Paulo Alcantara) [RHEL-138235] - cifs: fix sharing of DFS connections (Paulo Alcantara) [RHEL-138235] - cifs: avoid potential races when handling multiple dfs tcons (Paulo Alcantara) [RHEL-138235] - cifs: protect access of TCP_Server_Info::{origin,leaf}_fullpath (Paulo Alcantara) [RHEL-138235] - cifs: avoid dup prefix path in dfs_get_automount_devname() (Paulo Alcantara) [RHEL-138235] - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL (Paulo Alcantara) [RHEL-138235] {CVE-2023-53246} - smb3: fix unusable share after force unmount failure (Paulo Alcantara) [RHEL-138235] - cifs: check only tcon status on tcon related functions (Paulo Alcantara) [RHEL-138235] - cifs: return DFS root session id in DebugData (Paulo Alcantara) [RHEL-138235] - cifs: fix use-after-free bug in refresh_cache_worker() (Paulo Alcantara) [RHEL-138235] {CVE-2023-53052} - cifs: set DFS root session in cifs_get_smb_ses() (Paulo Alcantara) [RHEL-138235] - cifs: remove unused function (Paulo Alcantara) [RHEL-138235] - cifs: remove duplicate code in __refresh_tcon() (Paulo Alcantara) [RHEL-138235] - cifs: remove redundant assignment to the variable match (Paulo Alcantara) [RHEL-138235] - cifs: use origin fullpath for automounts (Paulo Alcantara) [RHEL-138235] - cifs: fix source pathname comparison of dfs supers (Paulo Alcantara) [RHEL-138235] - cifs: fix confusing debug message (Paulo Alcantara) [RHEL-138235] - cifs: don't block in dfs_cache_noreq_update_tgthint() (Paulo Alcantara) [RHEL-138235] - cifs: refresh root referrals (Paulo Alcantara) [RHEL-138235] - cifs: fix refresh of cached referrals (Paulo Alcantara) [RHEL-138235] - cifs: share dfs connections and supers (Paulo Alcantara) [RHEL-138235] - cifs: split out ses and tcon retrieval from mount_get_conns() (Paulo Alcantara) [RHEL-138235] - cifs: set resolved ip in sockaddr (Paulo Alcantara) [RHEL-138235] - cifs: remove unused smb3_fs_context::mount_options (Paulo Alcantara) [RHEL-138235] - cifs: get rid of mount options string parsing (Paulo Alcantara) [RHEL-138235] - cifs: use fs_context for automounts (Paulo Alcantara) [RHEL-138235] - cifs: remove various function description warnings (Paulo Alcantara) [RHEL-138235] - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Select which microcode patch to load (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add more known models to entry sign checking (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Limit Entrysign signature checking to known generations (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use sha256() instead of init/update/final (Waiman Long) [RHEL-132479] - x86/microcode: Fix Entrysign revision check for Zen1/Naples (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Handle the case of no BIOS microcode (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add some forgotten models to the SHA check (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Load only SHA256-checksummed patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add get_patch_level() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Merge early_apply_microcode() into its single callsite (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Have __apply_microcode_amd() return bool (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Flush patch buffer mapping after application (Waiman Long) [RHEL-132479] - x86/mm: Carve out INVLPG inline asm for use by others (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Split load_microcode_amd() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Pay attention to the stepping dynamically (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix a -Wsometimes-uninitialized clang false positive (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use the family,model,stepping encoded in the patch ID (Waiman Long) [RHEL-132479] - x86/microcode/amd: Cache builtin microcode too (Waiman Long) [RHEL-132479] - x86/microcode/amd: Use correct per CPU ucode_cpu_info (Waiman Long) [RHEL-132479] - x86/microcode/amd: Remove X86_32 specific code in early_apply_microcode() & get_builtin_microcode() (Waiman Long) [RHEL-132479] - x86/microcode: Move core specific defines to local header (Waiman Long) [RHEL-132479] - x86/microcode/intel: Rename get_datasize() since its used externally (Waiman Long) [RHEL-132479] - x86/microcode: Make reload_early_microcode() static (Waiman Long) [RHEL-132479] - x86/microcode: Include vendor headers into microcode.h (Waiman Long) [RHEL-132479] - x86/microcode/intel: Move microcode functions out of cpu/intel.c (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Get rid of __find_equiv_id() (Waiman Long) [RHEL-132479] - x86/microcode: Add explicit CPU vendor dependency (Waiman Long) [RHEL-132479] - macvlan: fix possible UAF in macvlan_forward_source() (Hangbin Liu) [RHEL-144120] {CVE-2026-23001} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-131922] - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount (Jocelyn Falempe) [RHEL-148636] - audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd references (Waiman Long) [RHEL-146026] - fs: Add a pool of extra fs->pwd references to fs_struct (Waiman Long) [RHEL-146026] - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143535] {CVE-2025-71085} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930] - NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242] - pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242] - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242] - NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242] - NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242] - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242] - SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242] - NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242] - SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242] - SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242] - SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242] - SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242] - NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242] - NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419] - nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419] - pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419] - NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419] - NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419] - NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419] - NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419] - NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419] - NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419] - NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419] - NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419] - NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419] - nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419] - nfs: always check dreq->error after a commit (Mike Snitzer) [RHEL-156419] - nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419] - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231} - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942] - x86/microcode/AMD: Revert "Backport AMD microcode commits for better microcode loading support" (Waiman Long) [RHEL-155860] - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150398] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150398] - tcp: fix forever orphan socket caused by tcp_abort (Paolo Abeni) [RHEL-146187] - xfs: fix minimum agno handling for xfs alloc modes in RHEL8 (Brian Foster) [RHEL-102464] - xfs: fix uninitialized use of flags variable in xfs_alloc_vextent() (Brian Foster) [RHEL-102464] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82523] - tcp: use this_cpu_read(*X) instead of *this_cpu_ptr(X) (Davide Caratti) [RHEL-82523] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150221] - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150221] {CVE-2026-23209} - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) [RHEL-96016] - s390/kexec: Emit an error message when cmdline is too long (Mete Durlu) [RHEL-144946] - s390/boot: Fix kernel size in bootparm area (Mete Durlu) [RHEL-144946] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-137123] - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-151614] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove useless transaction in evict_linked_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-151614] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-151614] - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146419] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146419] {CVE-2025-38323} - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136288] - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136288] - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136288] - scsi: st: Tighten the page format heuristics with MODE SELECT (John Meneghini) [RHEL-136288] - scsi: st: ERASE does not change tape location (John Meneghini) [RHEL-136288] - scsi: st: Fix array overflow in st_setup() (John Meneghini) [RHEL-136288] - scsi: st: Add sysfs file position_lost_in_reset (John Meneghini) [RHEL-136288] - scsi: st: Modify st.c to use the new scsi_error counters (John Meneghini) [RHEL-136288] - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (John Meneghini) [RHEL-136288] - scsi: st: Restore some drive settings after reset (John Meneghini) [RHEL-136288] - scsi: st: Fix input/output error on empty drive reset (John Meneghini) [RHEL-136288] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930] - NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242] - pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242] - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242] - NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242] - NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242] - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242] - SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242] - NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242] - SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242] - SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242] - SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242] - SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242] - NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242] - NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419] - nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419] - pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419] - NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419] - NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419] - NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419] - NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419] - NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419] - NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419] - NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419] - NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419] - NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419] - nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419] - nfs: always check dreq->error after a commit (Mike Snitzer) [RHEL-156419] - nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419] - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231} - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942] - xfrm: esp: avoid in-place decrypt on shared skb frags - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772] - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772] - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772] - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772] - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772] - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772] - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709} - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815] - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815] - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815] - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190} - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408} - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684} - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032] - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032] - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032] - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032] - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032] - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032] - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032] - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032] - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032] - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183} - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219] - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219] - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219] - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219] - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219] - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219] - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219] - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347} - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243} - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890] - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890] - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890] - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890] - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890] - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890] - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890] - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613} - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961] - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858} - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392} - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781} - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990} - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772] - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772] - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772] - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772] - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772] - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772] - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709} - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815] - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815] - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815] - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190} - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408} - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684} - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032] - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032] - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032] - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032] - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032] - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032] - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032] - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032] - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032] - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183} - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219] - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219] - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219] - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219] - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219] - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219] - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219] - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347} - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243} - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890] - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890] - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890] - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890] - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890] - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890] - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890] - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613} - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961] - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858} - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392} - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781} - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990} - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772] - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772] - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772] - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772] - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772] - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772] - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709} - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815] - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815] - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815] - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190} - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408} - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684} - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032] - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032] - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032] - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032] - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032] - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032] - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032] - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032] - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032] - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183} - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219] - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219] - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219] - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219] - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219] - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219] - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219] - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347} - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243} - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890] - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890] - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890] - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890] - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890] - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890] - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890] - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613} - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961] - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858} - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392} - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781} - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - [rt] build kernel-rt-4.18.0-553.16.1.rt7.357.el8_10 [RHEL-44553] - x86/bhi: Fix incorrect CLEAR_BRANCH_HISTORY position in entry_INT80_compat (Waiman Long) [RHEL-50648] - [rt] build kernel-rt-4.18.0-553.15.1.rt7.356.el8_10 [RHEL-44553] - Revert "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-44613] - ionic: fix use after netif_napi_del() (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - ionic: clean interrupt before enabling queue to avoid credit race (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change (CKI Backport Bot) [RHEL-49321] {CVE-2021-47624} - xhci: Handle TD clearing for multiple streams case (CKI Backport Bot) [RHEL-47882] {CVE-2024-40927} - net: openvswitch: Fix Use-After-Free in ovs_ct_exit (cki-backport-bot) [RHEL-36362] {CVE-2024-27395} - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: fix vlan use-after-free (cki-backport-bot) [RHEL-43721] {CVE-2024-36979} - irqchip/gic-v3-its: Prevent double free on error (Charles Mirabile) [RHEL-37022] {CVE-2024-35847} - irqchip/gic-v3-its: Fix potential VPE leak on error (Charles Mirabile) [RHEL-37744] {CVE-2021-47373} - i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() (Charles Mirabile) [RHEL-34735] {CVE-2022-48632} - iommu/dma: fix zeroing of bounce buffer padding used by untrusted devices (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: remove alloc_size argument to swiotlb_tbl_map_single() (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: fix swiotlb_bounce() to do partial sync's correctly (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Reinstate page-alignment for mappings >= PAGE_SIZE (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix alignment checks when both allocation and DMA masks are present (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix double-allocation of slots due to broken alignment handling (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (cki-backport-bot) [RHEL-44441] {CVE-2024-31076} - [rt] build kernel-rt-4.18.0-553.14.1.rt7.355.el8_10 [RHEL-44553] - s390/qeth: Fix kernel panic after setting hsuid (Mete Durlu) [RHEL-49754] - perf/core: Protect event sibling list locking against interrupt inversion (Daniel Vacek) [RHEL-31798] - vt: fix unicode buffer corruption when deleting characters (Steve Best) [RHEL-36936] {CVE-2024-35823} - cifs: translate network errors on send to -ECONNABORTED (Paulo Alcantara) [RHEL-36754] - xfs: don't block in busy flushing when freeing extents (Brian Foster) [RHEL-7984] - xfs: allow extent free intents to be retried (Brian Foster) [RHEL-7984] - xfs: pass alloc flags through to xfs_extent_busy_flush() (Brian Foster) [RHEL-7984] - xfs: use deferred frees for btree block freeing (Brian Foster) [RHEL-7984] - xfs: fix bounds check in xfs_defer_agfl_block() (Brian Foster) [RHEL-7984] - xfs: validate block number being freed before adding to xefi (Brian Foster) [RHEL-7984] - xfs: rename xfs_bmap_add_free to xfs_free_extent_later (Brian Foster) [RHEL-7984] - usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (Desnes Nunes) [RHEL-36803] {CVE-2024-35790} - stm class: Fix a double free in stm_register_device() (Steve Best) [RHEL-44514] {CVE-2024-38627} - s390/qeth: Fix potential loss of L3-IP@ in case of network issues (Mete Durlu) [RHEL-49755] - tls: fix missing memory barrier in tls_init (cki-backport-bot) [RHEL-44471] {CVE-2024-36489} - xfs: fix log recovery buffer allocation for the legacy h_size fixup (Bill O'Donnell) [RHEL-46473] {CVE-2024-39472} - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: use __for_each_thread() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - exit: Use the correct exit_code in /proc/<pid>/stat (Brian Foster) [RHEL-31562] {CVE-2024-26686} - scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool (Ewan D. Milne) [RHEL-38283] {CVE-2023-52811} - scsi: qla2xxx: Fix double free of fcport (Ewan D. Milne) [RHEL-39549] {CVE-2024-26929} - scsi: qla2xxx: Fix double free of the ha->vp_map pointer (Ewan D. Milne) [RHEL-39549] {CVE-2024-26930} - scsi: qla2xxx: Fix command flush on cable pull (Ewan D. Milne) [RHEL-39549] {CVE-2024-26931} - [rt] build kernel-rt-4.18.0-553.13.1.rt7.354.el8_10 [RHEL-44553] - redhat: remove handling of deleted rhdocs/ directory from genspec.sh (Denys Vlasenko) - x86/bugs: Fix BHI retpoline check (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI handling of RRSBA (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr' (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI documentation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix return type of spectre_bhi_state() (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Make CONFIG_SPECTRE_BHI_ON the default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Mitigate KVM by default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add BHI mitigation knob (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Enumerate Branch History Injection (BHI) bug (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Define SPEC_CTRL_BHI_DIS_S (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add support for clearing branch history at syscall entry (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file (Waiman Long) [RHEL-28202] - perf/x86/amd/lbr: Use freeze based on availability (Waiman Long) [RHEL-28202] - Documentation/kernel-parameters: Add spec_rstack_overflow to mitigations=off (Waiman Long) [RHEL-28202] - KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace (Waiman Long) [RHEL-28202] - x86/bugs: Reset speculation control settings on init (Waiman Long) [RHEL-28202] - KVM: x86: Update KVM-only leaf handling to allow for 100% KVM-only leafs (Waiman Long) [RHEL-28202] - KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest (Waiman Long) [RHEL-28202] - mptcp: ensure snd_nxt is properly initialized on connect (Davide Caratti) [RHEL-39865] {CVE-2024-36889} - powerpc/pseries: Enforce hcall result buffer validity and size (Mamatha Inamdar) [RHEL-48291] {CVE-2024-40974} - wifi: mac80211: fix potential key use-after-free (Jose Ignacio Tornos Martinez) [RHEL-28007] {CVE-2023-52530} - cppc_cpufreq: Fix possible null pointer dereference (Mark Langsdorf) [RHEL-44137] {CVE-2024-38573} - net/sched: act_mirred: use the backlog for mirred ingress (Davide Caratti) [RHEL-31718] {CVE-2024-26740} - vfio/pci: Lock external INTx masking ops (Alex Williamson) [RHEL-31922] {CVE-2024-26810} - net: sched: sch_multiq: fix possible OOB write in multiq_tune() (Davide Caratti) [RHEL-43464] {CVE-2024-36978} - tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized (Guillaume Nault) [RHEL-37850] {CVE-2021-47304} - pstore/ram: Fix crash when setting number of cpus to an odd number (Lenny Szubowicz) [RHEL-29471] {CVE-2023-52619} - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node (Jocelyn Falempe) [RHEL-37101] {CVE-2023-52662} - drm/vmwgfx: Fix the lifetime of the bo cursor memory (Jocelyn Falempe) [RHEL-36962] {CVE-2024-35810} - drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed (Jocelyn Falempe) [RHEL-34987] {CVE-2024-26940} - drm/vmwgfx: Unmap the surface before resetting it on a plane state (Jocelyn Falempe) [RHEL-35217] {CVE-2023-52648} - drm/vmwgfx: Fix invalid reads in fence signaled events (Jocelyn Falempe) [RHEL-40010] {CVE-2024-36960} - block: Fix wrong offset in bio_truncate() (Ming Lei) [RHEL-43782] {CVE-2022-48747} - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CKI Backport Bot) [RHEL-46913] {CVE-2024-39487} - net: fix __dst_negative_advice() race (Xin Long) [RHEL-41183] {CVE-2024-36971} - igc: avoid returning frame twice in XDP_REDIRECT (Corinna Vinschen) [RHEL-33264] {CVE-2024-26853} - mac802154: fix llsec key resources release in mac802154_llsec_key_del (Steve Best) [RHEL-34967] {CVE-2024-26961} - cpufreq: exit() callback is optional (Mark Langsdorf) [RHEL-43840] {CVE-2024-38615} - cifs: prevent infinite recursion in CIFSGetDFSRefer() (Paulo Alcantara) [RHEL-34672] - cifs: lock chan_lock outside match_session (Paulo Alcantara) [RHEL-34672] - smb3: workaround negprot bug in some Samba servers (Paulo Alcantara) [RHEL-34672] - smb3: use netname when available on secondary channels (Paulo Alcantara) [RHEL-34672] - smb3: fix empty netname context on secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: populate empty hostnames for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: always iterate smb sessions using primary channel (Paulo Alcantara) [RHEL-34672] - cifs: Fix connections leak when tlink setup failed (Paulo Alcantara) [RHEL-34672] - cifs: Fix memory leak when build ntlmssp negotiate blob failed (Paulo Alcantara) [RHEL-34672] - cifs: always initialize struct msghdr smb_msg completely (Paulo Alcantara) [RHEL-34672] - cifs: don't send down the destination address to sendmsg for a SOCK_STREAM (Paulo Alcantara) [RHEL-34672] - cifs: revalidate mapping when doing direct writes (Paulo Alcantara) [RHEL-34672] - cifs: skip extra NULL byte in filenames (Paulo Alcantara) [RHEL-34672] - cifs: list_for_each() -> list_for_each_entry() (Paulo Alcantara) [RHEL-34672] - smb2: small refactor in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - cifs: Fix crash on unload of cifs_arc4.ko (Paulo Alcantara) [RHEL-34672] - cifs: remove check of list iterator against head past the loop body (Paulo Alcantara) [RHEL-34672] - cifs: fix reconnect on smb3 mount types (Paulo Alcantara) [RHEL-34672] - cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (Paulo Alcantara) [RHEL-34672] - cifs: skip trailing separators of prefix paths (Paulo Alcantara) [RHEL-34672] - cifs: fix ntlmssp on old servers (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL ptr dereference in refresh_mounts() (Paulo Alcantara) [RHEL-34672] - cifs: do not skip link targets when an I/O fails (Paulo Alcantara) [RHEL-34672] - cifs: fix confusing unneeded warning message on smb2.1 and earlier (Paulo Alcantara) [RHEL-34672] - smb3: fix snapshot mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix workstation_name for multiuser mounts (Paulo Alcantara) [RHEL-34672] - cifs: alloc_path_with_tree_prefix: do not append sep. if the path is empty (Paulo Alcantara) [RHEL-34672] - cifs: free ntlmsspblob allocated in negotiate (Paulo Alcantara) [RHEL-34672] - cifs: avoid use of dstaddr as key for fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: add server conn_id to fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: fix missed refcounting of ipc tcon (Paulo Alcantara) [RHEL-34672] - smb2: clarify rc initialization in smb2_reconnect (Paulo Alcantara) [RHEL-34672] - cifs: populate server_hostname for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should be set on new server (Paulo Alcantara) [RHEL-34672] - cifs: introduce cifs_ses_mark_for_reconnect() helper (Paulo Alcantara) [RHEL-34672] - cifs: protect srv_count with cifs_tcp_ses_lock (Paulo Alcantara) [RHEL-34672] - cifs: move debug print out of spinlock (Paulo Alcantara) [RHEL-34672] - cifs: do not duplicate fscache cookie for secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: connect individual channel servers to primary channel server (Paulo Alcantara) [RHEL-34672] - cifs: protect session channel fields with chan_lock (Paulo Alcantara) [RHEL-34672] - cifs: do not negotiate session if session already exists (Paulo Alcantara) [RHEL-34672] - smb3: do not setup the fscache_super_cookie until fsinfo initialized (Paulo Alcantara) [RHEL-34672] - cifs: fix potential use-after-free bugs (Paulo Alcantara) [RHEL-34672] - cifs: release lock earlier in dequeue_mid error case (Paulo Alcantara) [RHEL-34672] - smb3: remove trivial dfs compile warning (Paulo Alcantara) [RHEL-34672] - cifs: support nested dfs links over reconnect (Paulo Alcantara) [RHEL-34672] - cifs: for compound requests, use open handle if possible (Paulo Alcantara) [RHEL-34672] - cifs: split out dfs code from cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant (Paulo Alcantara) [RHEL-34672] - cifs: introduce new helper for cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: fix print of hdr_flags in dfscache_proc_show() (Paulo Alcantara) [RHEL-34672] - cifs: send workstation name during ntlmssp session setup (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should not share socket with future sessions (Paulo Alcantara) [RHEL-34672] - smb3: add dynamic trace points for socket connection (Paulo Alcantara) [RHEL-34672] - cifs: Move SMB2_Create definitions to the shared area (Paulo Alcantara) [RHEL-34672] - cifs: Move more definitions into the shared area (Paulo Alcantara) [RHEL-34672] - cifs: move NEGOTIATE_PROTOCOL definitions out into the common area (Paulo Alcantara) [RHEL-34672] - cifs: Create a new shared file holding smb2 pdu definitions (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect check for null pointer in header_assemble (Paulo Alcantara) [RHEL-34672] - smb3: correct server pointer dereferencing check to be more consistent (Paulo Alcantara) [RHEL-34672] - cifs: Deal with some warnings from W=1 (Paulo Alcantara) [RHEL-34672] - cifs: fix a sign extension bug (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect kernel doc comments (Paulo Alcantara) [RHEL-34672] - cifs: remove pathname for file from SPDX header (Paulo Alcantara) [RHEL-34672] - cifs: move SMB FSCTL definitions to common code (Paulo Alcantara) [RHEL-34672] - cifs: rename cifs_common to smbfs_common (Paulo Alcantara) [RHEL-34672] - cifs: update FSCTL definitions (Paulo Alcantara) [RHEL-34672] - cifs: cifs_md4 convert to SPDX identifier (Paulo Alcantara) [RHEL-34672] - cifs: create a MD4 module and switch cifs.ko to use it (Paulo Alcantara) [RHEL-34672] - cifs: fork arc4 and create a separate module for it for cifs and other users (Paulo Alcantara) [RHEL-34672] - smb3: fix posix extensions mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix wrong release in sess_alloc_buffer() failed path (Paulo Alcantara) [RHEL-34672] - CIFS: Fix a potencially linear read overflow (Paulo Alcantara) [RHEL-34672] - cifs: use the correct max-length for dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: create sd context must be a multiple of 8 (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp sessions of dfs connections (Paulo Alcantara) [RHEL-34672] - cifs: added WARN_ON for all the count decrements (Paulo Alcantara) [RHEL-34672] - cifs: fix missing null session check in mount (Paulo Alcantara) [RHEL-34672] - cifs: handle reconnect of tcon when there is no cached dfs referral (Paulo Alcantara) [RHEL-34672] - cifs: fix the out of range assignment to bit fields in parse_server_interfaces (Paulo Alcantara) [RHEL-34672] - smb3: fix typo in header file (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: Add support for negotiating signing algorithm (Paulo Alcantara) [RHEL-34672] - cifs: prevent NULL deref in cifs_compose_mount_options() (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL dereference in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - smbdirect: missing rc checks while waiting for rdma events (Paulo Alcantara) [RHEL-34672] - cifs: Avoid field over-reading memcpy() (Paulo Alcantara) [RHEL-34672] - smb311: remove dead code for non compounded posix query info (Paulo Alcantara) [RHEL-34672] - cifs: fix SMB1 error path in cifs_get_file_info_unix (Paulo Alcantara) [RHEL-34672] - smb3: fix uninitialized value for port in witness protocol move (Paulo Alcantara) [RHEL-34672] - cifs: fix unneeded null check (Paulo Alcantara) [RHEL-34672] - cifs: use SPDX-Licence-Identifier (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in cifs_debug.c (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in smb2misc.c (Paulo Alcantara) [RHEL-34672] - cifs: missed ref-counting smb session in find (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp servers with dfs mounts (Paulo Alcantara) [RHEL-34672] - cifs: set a minimum of 2 minutes for refreshing dfs cache (Paulo Alcantara) [RHEL-34672] - cifs: Remove unused inline function is_sysvol_or_netlogon() (Paulo Alcantara) [RHEL-34672] - cifs: remove duplicated prototype (Paulo Alcantara) [RHEL-34672] - cifs: fix ipv6 formating in cifs_ses_add_channel (Paulo Alcantara) [RHEL-34672] - cifs: fix string declarations and assignments in tracepoints (Paulo Alcantara) [RHEL-34672] - cifs: fix memory leak in smb2_copychunk_range (Paulo Alcantara) [RHEL-34672] - SMB3: incorrect file id in requests compounded with open (Paulo Alcantara) [RHEL-34672] - smb3: if max_channels set to more than one channel request multichannel (Paulo Alcantara) [RHEL-34672] - smb3: do not attempt multichannel to server which does not support it (Paulo Alcantara) [RHEL-34672] - smb3: when mounting with multichannel include it in requested capabilities (Paulo Alcantara) [RHEL-34672] - cifs: simplify SWN code with dummy funcs instead of ifdefs (Paulo Alcantara) [RHEL-34672] - cifs: log mount errors using cifs_errorf() (Paulo Alcantara) [RHEL-34672] - cifs: switch build_path_from_dentry() to using dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: fix out-of-bound memory access when calling smb3_notify() at mount point (Paulo Alcantara) [RHEL-34672] - cifs: allocate buffer in the caller of build_path_from_dentry() (Paulo Alcantara) [RHEL-34672] - cifs: make build_path_from_dentry() return const char * (Paulo Alcantara) [RHEL-34672] - cifs: remove old dead code (Paulo Alcantara) [RHEL-34672] - fs: cifs: Remove repeated struct declaration (Paulo Alcantara) [RHEL-34672] - cifs: have cifs_fattr_to_inode() refuse to change type on live inode (Paulo Alcantara) [RHEL-34672] - cifs: have ->mkdir() handle race with another client sanely (Paulo Alcantara) [RHEL-34672] - do_cifs_create(): don't set ->i_mode of something we had not created (Paulo Alcantara) [RHEL-34672] - cifs: Silently ignore unknown oplock break handle (Paulo Alcantara) [RHEL-34672] - cifs: change noisy error message to FYI (Paulo Alcantara) [RHEL-34672] - cifs: print MIDs in decimal notation (Paulo Alcantara) [RHEL-34672] - cifs: minor simplification to smb2_is_network_name_deleted (Paulo Alcantara) [RHEL-34672] - TCON Reconnect during STATUS_NETWORK_NAME_DELETED (Paulo Alcantara) [RHEL-34672] - cifs: clarify hostname vs ip address in /proc/fs/cifs/DebugData (Paulo Alcantara) [RHEL-34672] - cifs: change confusing field serverName (to ip_addr) (Paulo Alcantara) [RHEL-34672] - cifs: Reformat DebugData and index connections by conn_id. (Paulo Alcantara) [RHEL-34672] - cifs: Identify a connection by a conn_id. (Paulo Alcantara) [RHEL-34672] - smb3: negotiate current dialect (SMB3.1.1) when version 3 or greater requested (Paulo Alcantara) [RHEL-34672] - smb3: Fix out-of-bounds bug in SMB2_negotiate() (Paulo Alcantara) [RHEL-34672] - fs/cifs: Simplify bool comparison. (Paulo Alcantara) [RHEL-34672] - fs/cifs: Assign boolean values to a bool variable (Paulo Alcantara) [RHEL-34672] - cifs: Avoid error pointer dereference (Paulo Alcantara) [RHEL-34672] - cifs: Re-indent cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Unlock on errors in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Delete a stray unlock in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Tracepoints and logs for tracing credit changes. (Paulo Alcantara) [RHEL-34672] - cifs: Fix some error pointers handling detected by static checker (Paulo Alcantara) [RHEL-34672] - smb3: remind users that witness protocol is experimental (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: do not log warning message if server doesn't populate salt (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: update comments clarifying SPNEGO info in negprot response (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot rsp (Paulo Alcantara) [RHEL-34672] - SMB3: avoid confusing warning message on mount to Azure (Paulo Alcantara) [RHEL-34672] - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (Nigel Croxon) [RHEL-46662] {CVE-2024-39476} - net: fix information leakage in /proc/net/ptype (Hangbin Liu) [RHEL-44000] {CVE-2022-48757} - usb: typec: ucsi: Limit read size on v1.2 (Desnes Nunes) [RHEL-37286] {CVE-2024-35924} - minmax: relax check to allow comparison between unsigned arguments and signed constants (Desnes Nunes) [RHEL-37286] - minmax: allow comparisons of 'int' against 'unsigned char/short' (Desnes Nunes) [RHEL-37286] - minmax: allow min()/max()/clamp() if the arguments have the same signedness. (Desnes Nunes) [RHEL-37286] - minmax: add umin(a, b) and umax(a, b) (Desnes Nunes) [RHEL-37286] - minmax: fix header inclusions (Desnes Nunes) [RHEL-37286] - minmax: clamp more efficiently by avoiding extra comparison (Desnes Nunes) [RHEL-37286] - minmax: sanity check constant bounds when clamping (Desnes Nunes) [RHEL-37286] - tracing: Define the is_signed_type() macro once (Desnes Nunes) [RHEL-37286] - linux/bits.h: fix compilation error with GENMASK (Desnes Nunes) [RHEL-37286] - x86/apic: Mask IOAPIC entries when disabling the local APIC (Lenny Szubowicz) [RHEL-18077] - userfaultfd: fix a race between writeprotect and exit_mmap() (Rafael Aquini) [RHEL-38410] {CVE-2021-47461} - mm: khugepaged: skip huge page collapse for special files (Waiman Long) [RHEL-38446] {CVE-2021-47491} - cachefiles: fix memory leak in cachefiles_add_cache() (Andrey Albershteyn) [RHEL-33109] {CVE-2024-26840} - drm/amd/display: Implement bounds check for stream encoder creation in DCN301 (Michel Dänzer) [RHEL-31429] {CVE-2024-26660} - net/mlx5: Discard command completions in internal error (Kamal Heib) [RHEL-44231] {CVE-2024-38555} - drm: Don't unref the same fb many times by mistake due to deadlock handling (CKI Backport Bot) [RHEL-29011] {CVE-2023-52486} - md: fix resync softlockup when bitmap size is less than array size (Nigel Croxon) [RHEL-43942] {CVE-2024-38598} - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation (Davide Caratti) [RHEL-39712] {CVE-2024-36017} - netfilter: nf_tables: discard table flag update with pending basechain deletion (Phil Sutter) [RHEL-37205] {CVE-2024-35897} - netfilter: nf_tables: reject table flag and netdev basechain updates (Phil Sutter) [RHEL-37205] - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (Ewan D. Milne) [RHEL-40172] {CVE-2024-36924} - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (Ewan D. Milne) [RHEL-40172] {CVE-2024-36952} - netfilter: nf_tables: fix memleak in map from abort path (Phil Sutter) [RHEL-35052] {CVE-2024-27011} - netfilter: nf_tables: reject new basechain after table flag update (Phil Sutter) [RHEL-37193] {CVE-2024-35900} - netfilter: nf_tables: flush pending destroy work before exit_net release (Phil Sutter) [RHEL-37197] {CVE-2024-35899} - netfilter: complete validation of user input (Phil Sutter) [RHEL-37210] - netfilter: validate user input for expected length (Phil Sutter) [RHEL-37210] {CVE-2024-35896} - netfilter: tproxy: bail out if IP has been disabled on the device (Phil Sutter) [RHEL-44363] {CVE-2024-36270} - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (Phil Sutter) [RHEL-44532] {CVE-2024-36286} - netfilter: nf_tables: do not compare internal table flags on updates (Phil Sutter) [RHEL-35114] {CVE-2024-27065} - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (Phil Sutter) [RHEL-35028] {CVE-2024-27019} - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (Phil Sutter) [RHEL-35024] {CVE-2024-27020} - netfilter: nf_tables: __nft_expr_type_get() selects specific family type (Phil Sutter) [RHEL-35024] - netfilter: conntrack: serialize hash resizes and cleanups (Phil Sutter) [RHEL-37703] {CVE-2021-47408} - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (Phil Sutter) [RHEL-34217] {CVE-2024-26925} - netfilter: nf_tables: release batch on table validation from abort path (Phil Sutter) [RHEL-34217] - ipvlan: add ipvlan_route_v6_outbound() helper (Davide Caratti) [RHEL-38319] {CVE-2023-52796} - [rt] build kernel-rt-4.18.0-553.12.1.rt7.353.el8_10 [RHEL-44553] - net: bridge: xmit: make sure we have at least eth header len bytes (cki-backport-bot) [RHEL-44291] {CVE-2024-38538} - drivers/amd/pm: fix a use-after-free in kv_parse_power_table (Michel Dänzer) [RHEL-26893] {CVE-2023-52469} - SUNRPC: Fix a suspicious RCU usage warning (Scott Mayhew) [RHEL-30503] {CVE-2023-52623} - ice: Fix some null pointer dereference issues in ice_ptp.c (Petr Oros) [RHEL-26901] {CVE-2023-52471} - xfs: fix internal error from AGFL exhaustion (Pavel Reichl) [RHEL-45581] - sched/psi: Fix use-after-free in ep_remove_wait_queue() (Phil Auld) [RHEL-38117] {CVE-2023-52707} - wait: add wake_up_pollfree() (Phil Auld) [RHEL-38117] - net/ipv6: avoid possible UAF in ip6_route_mpath_notify() (Hangbin Liu) [RHEL-33269] {CVE-2024-26852} - net: bridge: switchdev: Skip MDB replays of deferred events on offload (Ivan Vecera) [RHEL-33117] {CVE-2024-26837} - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (Pavel Reichl) [RHEL-31700] {CVE-2024-26772} - ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() (Pavel Reichl) [RHEL-31688] {CVE-2024-26773} - ext4: fix double-free of blocks due to wrong extents moved_len (Pavel Reichl) [RHEL-31612] {CVE-2024-26704} - vxlan: Pull inner IP header in vxlan_xmit_one(). (Guillaume Nault) [RHEL-31389] - geneve: Fix incorrect inner network header offset when innerprotoinherit is set (Guillaume Nault) [RHEL-31389] - vxlan: Pull inner IP header in vxlan_rcv(). (Guillaume Nault) [RHEL-31389] - geneve: fix header validation in geneve[6]_xmit_skb (Guillaume Nault) [RHEL-31389] - geneve: make sure to pull inner header in geneve_rx() (Guillaume Nault) [RHEL-31389] - net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb (Guillaume Nault) [RHEL-31389] - net: geneve: check skb is large enough for IPv4/IPv6 header (Guillaume Nault) [RHEL-31389] - net/smc: fix neighbour and rtable leak in smc_ib_find_route() (Tobias Huschle) [RHEL-39744] {CVE-2024-36945} - igb: Fix string truncation warnings in igb_set_fw_version (Corinna Vinschen) [RHEL-38452] {CVE-2024-36010} - bonding: stop the device in bond_setup_by_slave() (Hangbin Liu) [RHEL-38327] {CVE-2023-52784} - i40e: fix vf may be used uninitialized in this function warning (Kamal Heib) [RHEL-39702] {CVE-2024-36020} - powerpc/64: Fix the definition of the fixmap area (Mamatha Inamdar) [RHEL-27191] {CVE-2021-47018} - powerpc/mm/hash64: Add a variable to track the end of IO mapping (Mamatha Inamdar) [RHEL-27191] {CVE-2021-47018} - nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). (Xin Long) [RHEL-39770] {CVE-2024-36933} - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (Xin Long) [RHEL-39770] - net: core: reject skb_copy(_expand) for fraglist GSO skbs (Xin Long) [RHEL-39779] {CVE-2024-36929} - tcp: properly terminate timers for kernel sockets (Guillaume Nault) [RHEL-37171] {CVE-2024-35910} - net: relax socket state check at accept time. (Florian Westphal) [RHEL-39831] - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (Florian Westphal) [RHEL-39831] {CVE-2024-36905} - tcp: remove redundant check on tskb (Florian Westphal) [RHEL-39831] - drm/ast: Fix soft lockup (cki-backport-bot) [RHEL-37438] {CVE-2024-35952} - null_blk: Fix return value of nullb_device_power_store() (Ming Lei) [RHEL-39341] - null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues' (Ming Lei) [RHEL-39341] - null_blk: fix return value from null_add_dev() (Ming Lei) [RHEL-39341] - [rt] build kernel-rt-4.18.0-553.11.1.rt7.352.el8_10 [RHEL-44553] - x86/bugs: Reverse instruction order of CLEAR_CPU_BUFFERS (Waiman Long) [RHEL-42121] - Revert "x86/bugs: Use fixed addressing for VERW operand" (Waiman Long) [RHEL-42121] - KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests (Waiman Long) [RHEL-42121] - x86/rfds: Mitigate Register File Data Sampling (RFDS) (Waiman Long) [RHEL-42121] - Documentation/hw-vuln: Add documentation for RFDS (Waiman Long) [RHEL-42121] - x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set (Waiman Long) [RHEL-42121] - x86/bugs: Use fixed addressing for VERW operand (Waiman Long) [RHEL-42121] - KVM/VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH (Waiman Long) [RHEL-42121] - x86/bugs: Use ALTERNATIVE() instead of mds_user_clear static key (Waiman Long) [RHEL-42121] - x86/entry_32: Add VERW just before userspace transition (Waiman Long) [RHEL-42121] - x86/entry_64: Add VERW just before userspace transition (Waiman Long) [RHEL-42121] - x86/bugs: Add asm helpers for executing VERW (Waiman Long) [RHEL-42121] - x86/cpu: Fix Gracemont uarch (Waiman Long) [RHEL-42121] - Documentation/hw-vuln: Unify filename specification in index (Waiman Long) [RHEL-42121] - KVM: VMX: Access @flags as a 32-bit value in __vmx_vcpu_run() (Waiman Long) [RHEL-42121] - x86/asm: Add _ASM_RIP() macro for x86-64 (%rip) suffix (Waiman Long) [RHEL-42121] - x86/asm: Have the __ASM_FORM macros handle commas in arguments (Waiman Long) [RHEL-42121] - x86/asm: Allow to pass macros to __ASM_FORM() (Waiman Long) [RHEL-42121] - wifi: iwlwifi: mvm: guard against invalid STA ID on removal (Jose Ignacio Tornos Martinez) [RHEL-39801] {CVE-2024-36921} - ipv6: Fix potential uninit-value access in __ip6_make_skb() (Antoine Tenart) [RHEL-39784] - ipv4: Fix uninit-value access in __ip_make_skb() (Antoine Tenart) [RHEL-39784] {CVE-2024-36927} - perf mmap: Lazily initialize zstd streams to save memory when not using it (Michael Petlan) [RHEL-34876] - perf tools: Fix spelling mistake "commpressor" -> "compressor" (Michael Petlan) [RHEL-34876] - perf record: Introduce data transferred and compressed stats (Michael Petlan) [RHEL-34876] - perf record: Introduce compressor at mmap buffer object (Michael Petlan) [RHEL-34876] - perf record: Introduce bytes written stats (Michael Petlan) [RHEL-34876] - perf record: Introduce data file at mmap buffer object (Michael Petlan) [RHEL-34876] - perf record: Start threads in the beginning of trace streaming (Alexey Bayduraev) [RHEL-34876] - perf record: Stop threads in the end of trace streaming (Michael Petlan) [RHEL-34876] - perf record: Introduce thread local variable (Michael Petlan) [RHEL-34876] - perf record: Introduce function to propagate control commands (Michael Petlan) [RHEL-34876] - perf record: Introduce thread specific data array (Michael Petlan) [RHEL-34876] - tools lib: Introduce fdarray duplicate function (Michael Petlan) [RHEL-34876] - perf record: Introduce thread affinity and mmap masks (Michael Petlan) [RHEL-34876] - gfs2: Be more careful with the quota sync generation (Andreas Gruenbacher) [RHEL-40901] - gfs2: Get rid of some unnecessary quota locking (Andreas Gruenbacher) [RHEL-40901] - gfs2: Add some missing quota locking (Andreas Gruenbacher) [RHEL-40901] - gfs2: Fold qd_fish into gfs2_quota_sync (Andreas Gruenbacher) [RHEL-40901] - gfs2: quota need_sync cleanup (Andreas Gruenbacher) [RHEL-40901] - gfs2: Fix and clean up function do_qc (Andreas Gruenbacher) [RHEL-40901] - gfs2: Revert "Add quota_change type" (Andreas Gruenbacher) [RHEL-40901] - gfs2: Revert "ignore negated quota changes" (Andreas Gruenbacher) [RHEL-40901] - gfs2: qd_check_sync cleanups (Andreas Gruenbacher) [RHEL-40901] - gfs2: Check quota consistency on mount (Andreas Gruenbacher) [RHEL-40901] - gfs2: Minor gfs2_quota_init error path cleanup (Andreas Gruenbacher) [RHEL-40901] - gfs2: fix kernel BUG in gfs2_quota_cleanup (Edward Adam Davis) [RHEL-40901] - gfs2: Clean up quota.c:print_message (Andreas Gruenbacher) [RHEL-40901] - gfs2: Clean up gfs2_alloc_parms initializers (Andreas Gruenbacher) [RHEL-40901] - gfs2: Two quota=account mode fixes (Andreas Gruenbacher) [RHEL-40901] - gfs2: Remove useless assignment (Bob Peterson) [RHEL-40901] - gfs2: simplify slot_get (Bob Peterson) [RHEL-40901] - gfs2: Simplify qd2offset (Bob Peterson) [RHEL-40901] - gfs2: Remove quota allocation info from quota file (Bob Peterson) [RHEL-40901] - gfs2: use constant for array size (Bob Peterson) [RHEL-40901] - gfs2: Set qd_sync_gen in do_sync (Bob Peterson) [RHEL-40901] - gfs2: Remove useless err set (Bob Peterson) [RHEL-40901] - gfs2: Small gfs2_quota_lock cleanup (Bob Peterson) [RHEL-40901] - gfs2: move qdsb_put and reduce redundancy (Bob Peterson) [RHEL-40901] - gfs2: Don't try to sync non-changes (Bob Peterson) [RHEL-40901] - gfs2: Simplify function need_sync (Bob Peterson) [RHEL-40901] - gfs2: remove unneeded pg_oflow variable (Bob Peterson) [RHEL-40901] - gfs2: remove unneeded variable done (Bob Peterson) [RHEL-40901] - gfs2: pass sdp to gfs2_write_buf_to_page (Bob Peterson) [RHEL-40901] - gfs2: pass sdp in to gfs2_write_disk_quota (Bob Peterson) [RHEL-40901] - gfs2: Pass sdp to gfs2_adjust_quota (Bob Peterson) [RHEL-40901] - gfs2: remove dead code for quota writes (Bob Peterson) [RHEL-40901] - gfs2: Use qd_sbd more consequently (Bob Peterson) [RHEL-40901] - gfs2: replace 'found' with dedicated list iterator variable (Jakob Koschel) [RHEL-40901] - gfs2: Some whitespace cleanups (Andreas Gruenbacher) [RHEL-40901] - gfs2: Fix gfs2_qa_get imbalance in gfs2_quota_hold (Bob Peterson) [RHEL-40901] - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg (Guillaume Nault) [RHEL-43961] {CVE-2024-38596} - af_unix: Fix data-races around sk->sk_shutdown. (Guillaume Nault) [RHEL-43961] {CVE-2024-38596} - af_unix: Fix data races around sk->sk_shutdown. (Guillaume Nault) [RHEL-43961] {CVE-2024-38596} - perf/core: Fix event sibling list locking (Daniel Vacek) [RHEL-31798] - media: bttv: fix use after free error due to btv->timeout timer (Kate Hsuan) [RHEL-38256] {CVE-2023-52847} - arp: Prevent overflow in arp_req_get(). (Antoine Tenart) [RHEL-31706] {CVE-2024-26733} - Bluetooth: btusb: Add a new PID/VID 0489/e0c8 for MT7921 (David Marlin) [RHEL-10263] - mm: swap: fix race between free_swap_and_cache() and swapoff() (Waiman Long) [RHEL-34971] {CVE-2024-26960} - swap: comments get_swap_device() with usage rule (Waiman Long) [RHEL-34971] {CVE-2024-26960} - mm/swapfile.c: __swap_entry_free() always free 1 entry (Waiman Long) [RHEL-34971] {CVE-2024-26960} - mm/swapfile.c: call free_swap_slot() in __swap_entry_free() (Waiman Long) [RHEL-34971] {CVE-2024-26960} - mm/swapfile.c: use __try_to_reclaim_swap() in free_swap_and_cache() (Waiman Long) [RHEL-34971] {CVE-2024-26960} - net: amd-xgbe: Fix skb data length underflow (Ken Cox) [RHEL-43788] {CVE-2022-48743} - ovl: fix warning in ovl_create_real() (cki-backport-bot) [RHEL-43652] {CVE-2021-47579} - net/sched: initialize noop_qdisc owner (Davide Caratti) [RHEL-35056] - net/sched: Fix mirred deadlock on device recursion (Davide Caratti) [RHEL-35056] {CVE-2024-27010} - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (Pavel Reichl) [RHEL-45029] {CVE-2024-39276} - ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() (Ken Cox) [RHEL-38713] {CVE-2021-47548} - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound (Hangbin Liu) [RHEL-44396] {CVE-2024-33621} - mlxsw: spectrum_acl_tcam: Fix stack corruption (Ivan Vecera) [RHEL-26462] {CVE-2024-26586} - inet: inet_defrag: prevent sk release while still in use (Antoine Tenart) [RHEL-33398] {CVE-2024-26921} - skb_expand_head() adjust skb->truesize incorrectly (Antoine Tenart) [RHEL-33398] - nvmet: fix ns enable/disable possible hang (Ming Lei) [RHEL-43547] - [rt] build kernel-rt-4.18.0-553.10.1.rt7.351.el8_10 [RHEL-44553] - SUNRPC: Fix RPC client cleaned up the freed pipefs dentries (Scott Mayhew) [RHEL-38264] {CVE-2023-52803} - scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() (Ewan D. Milne) [RHEL-39717] {CVE-2024-36025} - tcp: add sanity checks to rx zerocopy (Guillaume Nault) [RHEL-29494] {CVE-2024-26640} - SUNRPC: fix some memleaks in gssx_dec_option_array (Scott Mayhew) [RHEL-35209] {CVE-2024-27388} - wifi: nl80211: don't free NULL coalescing rule (Jose Ignacio Tornos Martinez) [RHEL-39752] {CVE-2024-36941} - nfs: fix UAF in direct writes (Scott Mayhew) [RHEL-34975] {CVE-2024-26958} - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 (Scott Mayhew) [RHEL-33228] {CVE-2024-26870} - drm/amd/pm: Fix error of MACO flag setting code (Michel Dänzer) [RHEL-15928] - scsi: aacraid: fix io hangs and improve performance (John Meneghini) [RHEL-23913] - block: prevent division by zero in blk_rq_stat_sum() (Ming Lei) [RHEL-37279] {CVE-2024-35925} - block: fix overflow in blk_ioctl_discard() (Ming Lei) [RHEL-39811] {CVE-2024-36917} - virtio-blk: fix implicit overflow on virtio_max_dma_size (Ming Lei) [RHEL-38131] {CVE-2023-52762} - nbd: null check for nla_nest_start (Ming Lei) [RHEL-35176] {CVE-2024-27025} - isdn: mISDN: netjet: Fix crash in nj_probe: (Ken Cox) [RHEL-38444] {CVE-2021-47284} - isdn: mISDN: Fix sleeping function called from invalid context (Ken Cox) [RHEL-38400] {CVE-2021-47468} - net/smc: avoid data corruption caused by decline (Tobias Huschle) [RHEL-38234] {CVE-2023-52775} - ubi: Check for too small LEB size in VTBL code (David Arcari) [RHEL-25092] {CVE-2024-25739} - i2c: core: Fix atomic xfer check for non-preempt config (Steve Best) [RHEL-38313] {CVE-2023-52791} - i2c: core: Run atomic i2c xfer when !preemptible (Steve Best) [RHEL-38313] {CVE-2023-52791} - firewire: ohci: mask bus reset interrupts between ISR and bottom half (Steve Best) [RHEL-39902] {CVE-2024-36950} - ipv6: init the accept_queue's spinlocks in inet6_create (Guillaume Nault) [RHEL-28899] {CVE-2024-26614} - tcp: make sure init the accept_queue's spinlocks once (Guillaume Nault) [RHEL-28899] {CVE-2024-26614} - tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (Steve Best) [RHEL-39352] {CVE-2024-36016} - mlxsw: spectrum_acl_tcam: Fix incorrect list API usage (Ivan Vecera) [RHEL-37484] {CVE-2024-36006} - pwm: Fix double shift bug (Steve Best) [RHEL-38278] {CVE-2023-52756} - mmc: sdio: fix possible resource leaks in some error paths (Steve Best) [RHEL-38149] {CVE-2023-52730} - of: unittest: Fix compile in the non-dynamic case (Steve Best) [RHEL-37070] {CVE-2023-52679} - of: unittest: Fix of_count_phandle_with_args() expected value message (Steve Best) [RHEL-37070] {CVE-2023-52679} - of: Fix double free in of_parse_phandle_with_args_map (Steve Best) [RHEL-37070] {CVE-2023-52679} - pinctrl: core: delete incorrect free in pinctrl_enable() (Steve Best) [RHEL-39756] {CVE-2024-36940} - pinctrl: core: fix possible memory leak in pinctrl_enable() (Steve Best) [RHEL-39756] {CVE-2024-36940} - media: gspca: cpia1: shift-out-of-bounds in set_flicker (Desnes Nunes) [RHEL-38331] {CVE-2023-52764} - tipc: fix a possible memleak in tipc_buf_append (Xin Long) [RHEL-39881] {CVE-2024-36954} - cifs: fix mid leak during reconnection after timeout threshold (Paulo Alcantara) [RHEL-36222] - cifs: Fix use-after-free in rdata->read_into_pages() (Paulo Alcantara) [RHEL-36222] - cifs: Fix pages leak when writedata alloc failed in cifs_write_from_iter() (Paulo Alcantara) [RHEL-36222] - cifs: Fix pages array leak when writedata alloc failed in cifs_writedata_alloc() (Paulo Alcantara) [RHEL-36222] - cifs: destage dirty pages before re-reading them for cache=none (Paulo Alcantara) [RHEL-36222] - cifs: destage any unwritten data to the server before calling copychunk_write (Paulo Alcantara) [RHEL-36222] - Adjust cifssb maximum read size (Paulo Alcantara) [RHEL-36222] - cifs: make locking consistent around the server session status (Paulo Alcantara) [RHEL-36222] - cifs: fix credit accounting for extra channel (Paulo Alcantara) [RHEL-36222] - smb3: prevent races updating CurrentMid (Paulo Alcantara) [RHEL-36222] - cifs: fix missing spinlock around update to ses->status (Paulo Alcantara) [RHEL-36222] - cifs: use echo_interval even when connection not ready. (Paulo Alcantara) [RHEL-36222] - cifs: detect dead connections only when echoes are enabled. (Paulo Alcantara) [RHEL-36222] - cifs: Fix preauth hash corruption (Paulo Alcantara) [RHEL-36222] - cifs: do not send close in compound create+close requests (Paulo Alcantara) [RHEL-36222] - cifs: ask for more credit on async read/write code paths (Paulo Alcantara) [RHEL-36222] - cifs: use discard iterator to discard unneeded network data more efficiently (Paulo Alcantara) [RHEL-36222] - cifs: Fix in error types returned for out-of-credit situations. (Paulo Alcantara) [RHEL-36222] - smb3: fix crediting for compounding when only one request in flight (Paulo Alcantara) [RHEL-36222] - cifs: New optype for session operations. (Paulo Alcantara) [RHEL-36222] - mm/gup: do not return 0 from pin_user_pages_fast() for bad args (Paulo Alcantara) [RHEL-36222] - wifi: brcmfmac: pcie: handle randbuf allocation failure (Jose Ignacio Tornos Martinez) [RHEL-44124] {CVE-2024-38575} - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). (Guillaume Nault) [RHEL-39835] {CVE-2024-36904} - wifi: mac80211: don't return unset power in ieee80211_get_tx_power() (Jose Ignacio Tornos Martinez) [RHEL-38159] {CVE-2023-52832} - wifi: ath11k: fix gtk offload status event locking (Jose Ignacio Tornos Martinez) [RHEL-38155] {CVE-2023-52777} - net: ieee802154: fix null deref in parse dev addr (Steve Best) [RHEL-38012] {CVE-2021-47257} - mm/hugetlb: fix missing hugetlb_lock for resv uncharge (Rafael Aquini) [RHEL-37465] {CVE-2024-36000} - x86/xen: Add some null pointer checking to smp.c (Vitaly Kuznetsov) [RHEL-33258] {CVE-2024-26908} - x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() (Vitaly Kuznetsov) [RHEL-33258] {CVE-2024-26908} - wifi: cfg80211: check A-MSDU format more carefully (Jose Ignacio Tornos Martinez) [RHEL-37343] {CVE-2024-35937} - wifi: rtw89: fix null pointer access when abort scan (Jose Ignacio Tornos Martinez) [RHEL-37355] {CVE-2024-35946} - atl1c: Work around the DMA RX overflow issue (Ken Cox) [RHEL-38287] {CVE-2023-52834} - wifi: ath11k: decrease MHI channel buffer length to 8KB (Jose Ignacio Tornos Martinez) [RHEL-37339] {CVE-2024-35938} - wifi: iwlwifi: mvm: rfi: fix potential response leaks (Jose Ignacio Tornos Martinez) [RHEL-37163] {CVE-2024-35912} - USB: core: Fix access violation during port device removal (Desnes Nunes) [RHEL-39853] {CVE-2024-36896} - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() (Ewan D. Milne) [RHEL-37123] {CVE-2024-35930} - netfilter: nf_tables: honor table dormant flag from netdev release event path (Phil Sutter) [RHEL-37450] {CVE-2024-36005} - wifi: iwlwifi: mvm: don't set the MFP flag for the GTK (Jose Ignacio Tornos Martinez) [RHEL-36898] {CVE-2024-27434} - wifi: iwlwifi: mvm: Fix key flags for IGTK on AP interface (Jose Ignacio Tornos Martinez) [RHEL-36898] {CVE-2024-27434} - misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspend/resume (Steve Best) [RHEL-36932] {CVE-2024-35824} - [rt] build kernel-rt-4.18.0-553.9.1.rt7.350.el8_10 [RHEL-44553] - x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (Steve Best) [RHEL-37262] {CVE-2024-35876} - net/sched: flower: Fix chain template offload (Xin Long) [RHEL-31313] {CVE-2024-26669} - SUNRPC: fix a memleak in gss_import_v2_context (Scott Mayhew) [RHEL-35195] {CVE-2023-52653} - efivarfs: force RO when remounting if SetVariable is not supported (Pavel Reichl) [RHEL-26564] {CVE-2023-52463} - dmaengine: idxd: add a write() method for applications to submit work (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823} - dmaengine: idxd: add a new security check to deal with a hardware erratum (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823} - VFIO: Add the SPR_DSA and SPR_IAX devices to the denylist (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823} - quota: Fix potential NULL pointer dereference (Pavel Reichl) [RHEL-33219] {CVE-2024-26878} - locking/lockdep: Fix overflow in presentation of average lock-time (Čestmír Kalina) [RHEL-17678] - blk-cgroup: Properly propagate the iostat update up the hierarchy (Ming Lei) [RHEL-40939] - proc: Use new_inode not new_inode_pseudo (Ian Kent) [RHEL-40167] - stmmac: Clear variable when destroying workqueue (Izabela Bakollari) [RHEL-31822] {CVE-2024-26802} - powerpc/pseries/memhp: Fix access beyond end of drmem array (Mamatha Inamdar) [RHEL-26495] {CVE-2023-52451} - platform/x86: wmi: Fix opening of char device (David Arcari) [RHEL-38258] {CVE-2023-52864} - Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" (Kamal Heib) [RHEL-36908] {CVE-2023-52658} - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed (Cathy Avery) [RHEL-39074] - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove (Cathy Avery) [RHEL-39074] - hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes (Cathy Avery) [RHEL-39074] - hv_netvsc: remove duplicated including of slab.h (Cathy Avery) [RHEL-39074] - hv_netvsc: rndis_filter needs to select NLS (Cathy Avery) [RHEL-39074] - hv_netvsc: Mark VF as slave before exposing it to user-mode (Cathy Avery) [RHEL-39074] - hv_netvsc: Fix race of register_netdevice_notifier and VF register (Cathy Avery) [RHEL-39074] - hv_netvsc: fix race of netvsc and VF register_netdevice (Cathy Avery) [RHEL-39074] - hv_netvsc: fix netvsc_send_completion to avoid multiple message length checks (Cathy Avery) [RHEL-39074] - hv_netvsc: Allocate rx indirection table size dynamically (Cathy Avery) [RHEL-39074] - net: hv_netvsc: Fix a warning triggered by memcpy in rndis_filter (Cathy Avery) [RHEL-39074] - gfs2: Fix lru_count accounting (Andreas Gruenbacher) [RHEL-32941] - gfs2: Fix "Make glock lru list scanning safer" (Andreas Gruenbacher) [RHEL-32941] - gfs2: Fix "ignore unlock failures after withdraw" (Andreas Gruenbacher) [RHEL-32941] - gfs2: Don't set GLF_LOCK in gfs2_dispose_glock_lru (Andreas Gruenbacher) [RHEL-32941] - gfs2: Don't forget to complete delayed withdraw (Andreas Gruenbacher) [RHEL-32941] - gfs2: Delay withdraw from atomic context (Andreas Gruenbacher) [RHEL-32941] - gfs2: trivial clean up of gfs2_ail_error (Andreas Gruenbacher) [RHEL-32941] - ext4: fix corruption during on-line resize (Carlos Maiolino) [RHEL-36974] {CVE-2024-35807} - ext4: correct offset of gdb backup in non meta_bg group to update_backups (Carlos Maiolino) [RHEL-36974] - ext4: avoid online resizing failures due to oversized flex bg (Carlos Maiolino) [RHEL-30507] {CVE-2023-52622} - ext4: use time_is_before_jiffies() instead of open coding it (Carlos Maiolino) [RHEL-30507] - ext4: unify the type of flexbg_size to unsigned int (Carlos Maiolino) [RHEL-30507] - ext4: remove unnecessary check from alloc_flex_gd() (Carlos Maiolino) [RHEL-30507] - tracing: Do no increment trace_clock_global() by one (Jerome Marchand) [RHEL-27107] {CVE-2021-46939} - tracing: Restructure trace_clock_global() to never block (Jerome Marchand) [RHEL-27107] {CVE-2021-46939} - net/sched: act_skbmod: prevent kernel-infoleak (Xin Long) [RHEL-37220] {CVE-2024-35893} - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (Xin Long) [RHEL-38307] {CVE-2023-52845} - redhat: remove the merge subtrees script (Derek Barbosa) - redhat: rhdocs: delete .get_maintainer.conf (Derek Barbosa) - redhat: rhdocs: Remove the rhdocs directory (Derek Barbosa) - dyndbg: fix old BUG_ON in >control parser (Waiman Long) [RHEL-37111] {CVE-2024-35947} - dyndbg: let query-modname override actual module name (Waiman Long) [RHEL-37111] - dyndbg: make dyndbg a known cli param (Waiman Long) [RHEL-37111] - lan78xx: Fix exception on link speed change (Jamie Bainbridge) [RHEL-33437] - net: usb: lan78xx: don't modify phy_device state concurrently (Jamie Bainbridge) [RHEL-33437] - efi: runtime: Fix potential overflow of soft-reserved region size (Lenny Szubowicz) [RHEL-33096] {CVE-2024-26843} - perf/arm-cmn: Fail DTC counter allocation correctly (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Rework DTC counters (again) (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Fix DTC domain detection (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Revamp model detection (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Fix port detection for CMN-700 (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Move overlapping wp_combine field (Michael Petlan) [RHEL-23841] - Partially revert "perf/arm-cmn: Optimise DTC counter accesses" (Michael Petlan) [RHEL-23841] - drivers/perf: Compile with gnu99 standard (Michael Petlan) [RHEL-23841] - x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (Steve Best) [RHEL-36994] {CVE-2024-35801} - watchdog: softdog: Add options 'soft_reboot_cmd' and 'soft_active_on_boot' (Waiman Long) [RHEL-19723] - tipc: fix UAF in error path (Xin Long) [RHEL-34278] {CVE-2024-36886} - [rt] build kernel-rt-4.18.0-553.8.1.rt7.349.el8_10 [RHEL-40882] - udf: Fix NULL pointer dereference in udf_symlink function (Pavel Reichl) [RHEL-37769] {CVE-2021-47353} - net: ti: fix UAF in tlan_remove_one (Jose Ignacio Tornos Martinez) [RHEL-38940] {CVE-2021-47310} - ARM: footbridge: fix PCI interrupt mapping (Myron Stowe) [RHEL-26971] {CVE-2021-46909} - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (Kamal Heib) [RHEL-37454] {CVE-2024-36004} - net/mlx5e: Fix mlx5e_priv_init() cleanup flow (Kamal Heib) [RHEL-37424] {CVE-2024-35959} - net/mlx5: Properly link new fs rules into the tree (Kamal Heib) [RHEL-37420] {CVE-2024-35960} - net/mlx5e: fix a potential double-free in fs_any_create_groups (Kamal Heib) [RHEL-37091] {CVE-2023-52667} - net: ena: Fix incorrect descriptor free behavior (Kamal Heib) [RHEL-37428] {CVE-2024-35958} - mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - mISDN: fix possible use-after-free in HFC_cleanup() (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - implement dh fallback for primes > 4K (Vladis Dronov) [RHEL-35106] - crypto: qat - avoid division by zero (Vladis Dronov) [RHEL-35106] - crypto: qat - resolve race condition during AER recovery (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - use kcalloc_node() instead of kzalloc_node() (Vladis Dronov) [RHEL-35106] - [rt] Enable CONFIG_DRM_MGAG200_DISABLE_WRITECOMBINE (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Add an option to disable Write-Combine (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Fix caching setup for remapped video memory (Jocelyn Falempe) [RHEL-36172] - Revert "drm/mgag200: Add a workaround for low-latency" (Jocelyn Falempe) [RHEL-36172] - mptcp: fix data re-injection from stale subflow (Davide Caratti) [RHEL-33133] {CVE-2024-26826} - ipv6: sr: fix incorrect unregister order (Hangbin Liu) [RHEL-31730] - ipv6: sr: fix possible use-after-free and null-ptr-deref (Hangbin Liu) [RHEL-31730] {CVE-2024-26735} - net/bnx2x: Prevent access to a freed page in page_pool (Michal Schmidt) [RHEL-14195 RHEL-33243] {CVE-2024-26859} - bnx2x: new flag for track HW resource allocation (Michal Schmidt) [RHEL-14195 RHEL-33243] - bnx2x: fix page fault following EEH recovery (Michal Schmidt) [RHEL-14195 RHEL-33243] - x86: KVM: SVM: always update the x2avic msr interception (Maxim Levitsky) [RHEL-15495] {CVE-2023-5090} - EDAC/thunderx: Fix possible out-of-bounds string access (Aristeu Rozanski) [RHEL-26573] {CVE-2023-52464} - [rt] build kernel-rt-4.18.0-553.7.1.rt7.348.el8_10 [RHEL-34640] - net: qcom/emac: fix UAF in emac_remove (Ken Cox) [RHEL-37834] {CVE-2021-47311} - perf/core: Bail out early if the request AUX area is out of bound (Michael Petlan) [RHEL-38268] {CVE-2023-52835} - crypto: pcrypt - Fix hungtask for PADATA_RESET (Herbert Xu) [RHEL-38171] {CVE-2023-52813} - drm/amdgpu: fix use-after-free bug (Jocelyn Falempe) [RHEL-31240] {CVE-2024-26656} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash (Ivan Vecera) [RHEL-37008] {CVE-2024-35854} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update (Ivan Vecera) [RHEL-37004] {CVE-2024-35855} - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (Ivan Vecera) [RHEL-37012] {CVE-2024-35853} - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work (Ivan Vecera) [RHEL-37016] {CVE-2024-35852} - mlxsw: spectrum_acl_tcam: Fix warning during rehash (Ivan Vecera) [RHEL-37480] {CVE-2024-36007} - can: peak_pci: peak_pci_remove(): fix UAF (Jose Ignacio Tornos Martinez) [RHEL-38419] {CVE-2021-47456} - usbnet: fix error return code in usbnet_probe() (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - usbnet: sanity check for maxpacket (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - net/mlx5e: fix a double-free in arfs_create_groups (Kamal Heib) [RHEL-36920] {CVE-2024-35835} - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds (Jose Ignacio Tornos Martinez) [RHEL-38220] {CVE-2023-52878} - net: cdc_eem: fix tx fixup skb leak (Jose Ignacio Tornos Martinez) [RHEL-38080] {CVE-2021-47236} - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Jose Ignacio Tornos Martinez) [RHEL-38113] {CVE-2023-52703} - usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() (Desnes Nunes) [RHEL-38248] {CVE-2023-52877} - usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (Desnes Nunes) [RHEL-38240] {CVE-2023-52781} - gro: fix ownership transfer (Xin Long) [RHEL-37226] {CVE-2024-35890} - tipc: fix kernel warning when sending SYN message (Xin Long) [RHEL-38109] {CVE-2023-52700} - erspan: make sure erspan_base_hdr is present in skb->head (Xin Long) [RHEL-37230] {CVE-2024-35888} - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() (Bryan Gurney) [RHEL-17366] - scsi: mpi3mr: Sanitise num_phys (Bryan Gurney) [RHEL-17366] - netfilter: nf_tables: use timestamp to check for set element timeout (Phil Sutter) [RHEL-38023] {CVE-2024-27397} - net/ipv6: SKB symmetric hash should incorporate transport ports (Sabrina Dubroca) [RHEL-32061] - crypto: s390/aes - Fix buffer overread in CTR mode (Herbert Xu) [RHEL-37089] {CVE-2023-52669} - net: Save and restore msg_namelen in sock_sendmsg (Jamie Bainbridge) [RHEL-35893] - net: prevent address rewrite in kernel_bind() (Jamie Bainbridge) [RHEL-35893] - net: prevent rewrite of msg_name in sock_sendmsg() (Jamie Bainbridge) [RHEL-35893] - net: replace calls to sock->ops->connect() with kernel_connect() (Jamie Bainbridge) [RHEL-35893] - net: Avoid address overwrite in kernel_connect (Jamie Bainbridge) [RHEL-35893] - wifi: iwlwifi: dbg-tlv: ensure NUL termination (Jose Ignacio Tornos Martinez) [RHEL-37026] {CVE-2024-35845} - wifi: mac80211: fix potential sta-link leak (Jose Ignacio Tornos Martinez) [RHEL-36916] {CVE-2024-35838} - wifi: nl80211: reject iftype change with mesh ID change (Jose Ignacio Tornos Martinez) [RHEL-36884] {CVE-2024-27410} - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (Jose Ignacio Tornos Martinez) [RHEL-36807] {CVE-2024-35789} - Bluetooth: Avoid potential use-after-free in hci_error_reset (David Marlin) [RHEL-31826] {CVE-2024-26801} - tls: disable async encrypt/decrypt (Sabrina Dubroca) [RHEL-26362 RHEL-26409 RHEL-26420] {CVE-2024-26585 CVE-2024-26583 CVE-2024-26584} - Squashfs: check the inode number is not the invalid value of zero (Phillip Lougher) [RHEL-35096] {CVE-2024-26982} - ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/msg.c: update and document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/sem.c: document and update memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: update/document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: remove duplicated code (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (Kamal Heib) [RHEL-30582] {CVE-2023-52626} - Revert "ACPI: bus: Rework system-level device notification handling" (Prarit Bhargava) [RHEL-21486] - hwrng: core - Fix page fault dead lock on mmap-ed hwrng (Prarit Bhargava) [RHEL-29485] {CVE-2023-52615} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - powerpc/pseries: pci - logic bug (Mamatha Inamdar) [RHEL-240146] - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228} - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899] {CVE-2026-90036} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680] {CVE-2026-72262} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641} - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781] {CVE-2026-74583} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916] {CVE-2026-68377} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271288] {CVE-2026-89631} - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280060] {CVE-2026-98320} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271853] {CVE-2026-93817} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191034] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191034] {CVE-2026-53196} - gfs2: a minor finish_xmote cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor run_queue fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: only apply DLM_LKF_VALBLK if sb_lvbptr is not NULL (Alexander Aring) [RHEL-129363] - gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Use wait_event_freezable_timeout() for freezable kthread (Andreas Gruenbacher) [RHEL-129363] - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-129363] - gfs2: low-memory forced flush fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: add missing withdraw locking (Andreas Gruenbacher) [RHEL-129363] - gfs2: Disable GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename "gfs_recovery" workqueue to "gfs2_recovery" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-129363] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-129363] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify do_promote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-129363] - gfs2: introduce new gfs2_glock_assert_withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify refcounting in do_xmote (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Make recovery error more readable (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark the remaining process-independent glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark flock glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of newlines in log messages (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-129363] - gfs2: Sanitize kthread stopping (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix logd wakeup on I/O error (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_quotad (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_logd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove duplicate check in do_xmote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove space before newline (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix LM_FLAG_TRY* logic in add_to_queue (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove DLM_LKF_ALTCW / DLM_LKF_ALTPR code (Andreas Gruenbacher) [RHEL-129363] - gfs2: Further sanitize lock_dlm.c (Andreas Gruenbacher) [RHEL-129363] - gfs2: sanitize the gdlm_ast -> finish_xmote interface (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify DLM_LKF_QUECVT use (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-129363] - gfs2: Lift withdraw check out of gfs2_ail1_empty (Andreas Gruenbacher) [RHEL-129363] - gfs2: don't withdraw if init_threads() got interrupted (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-129363] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix slab-use-after-free in gfs2_qd_dealloc (Andreas Gruenbacher) [RHEL-129363] {CVE-2023-52760} - gfs2: Fix asynchronous thread destruction (Andreas Gruenbacher) [RHEL-129363] - gfs2: Stop using gfs2_make_fs_ro for withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-129363] - gfs2: Turn gfs2_withdraw into a void function (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark withdraws as unlikely (Andreas Gruenbacher) [RHEL-129363] - gfs2: ignore rindex_update failure in dinode_dealloc (Andreas Gruenbacher) [RHEL-129363] - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270732] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256684] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256684] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256684] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271657] {CVE-2026-93288} - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254282] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-263292] {CVE-2026-89479} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254357] {CVE-2026-74588} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222954] {CVE-2026-52935} - powerpc/pseries: pci - logic bug (Mamatha Inamdar) [RHEL-240146] - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228} - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899] {CVE-2026-90036} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680] {CVE-2026-72262} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641} - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781] {CVE-2026-74583} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916] {CVE-2026-68377} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270905] {CVE-2026-89777} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263644] {CVE-2026-68202} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254200] {CVE-2026-80590} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233134] {CVE-2026-64572} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225459] {CVE-2026-64114} - xfs: bounds-check buffer log item's dirty bitmap (CKI Backport Bot) [RHEL-253365] {CVE-2026-80536} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234242] {CVE-2026-64266} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271288] {CVE-2026-89631} - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280060] {CVE-2026-98320} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271853] {CVE-2026-93817} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191034] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191034] {CVE-2026-53196} - gfs2: a minor finish_xmote cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor run_queue fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: only apply DLM_LKF_VALBLK if sb_lvbptr is not NULL (Alexander Aring) [RHEL-129363] - gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Use wait_event_freezable_timeout() for freezable kthread (Andreas Gruenbacher) [RHEL-129363] - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-129363] - gfs2: low-memory forced flush fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: add missing withdraw locking (Andreas Gruenbacher) [RHEL-129363] - gfs2: Disable GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename "gfs_recovery" workqueue to "gfs2_recovery" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-129363] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-129363] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify do_promote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-129363] - gfs2: introduce new gfs2_glock_assert_withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify refcounting in do_xmote (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Make recovery error more readable (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark the remaining process-independent glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark flock glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of newlines in log messages (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-129363] - gfs2: Sanitize kthread stopping (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix logd wakeup on I/O error (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_quotad (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_logd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove duplicate check in do_xmote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove space before newline (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix LM_FLAG_TRY* logic in add_to_queue (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove DLM_LKF_ALTCW / DLM_LKF_ALTPR code (Andreas Gruenbacher) [RHEL-129363] - gfs2: Further sanitize lock_dlm.c (Andreas Gruenbacher) [RHEL-129363] - gfs2: sanitize the gdlm_ast -> finish_xmote interface (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify DLM_LKF_QUECVT use (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-129363] - gfs2: Lift withdraw check out of gfs2_ail1_empty (Andreas Gruenbacher) [RHEL-129363] - gfs2: don't withdraw if init_threads() got interrupted (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-129363] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix slab-use-after-free in gfs2_qd_dealloc (Andreas Gruenbacher) [RHEL-129363] {CVE-2023-52760} - gfs2: Fix asynchronous thread destruction (Andreas Gruenbacher) [RHEL-129363] - gfs2: Stop using gfs2_make_fs_ro for withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-129363] - gfs2: Turn gfs2_withdraw into a void function (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark withdraws as unlikely (Andreas Gruenbacher) [RHEL-129363] - gfs2: ignore rindex_update failure in dinode_dealloc (Andreas Gruenbacher) [RHEL-129363] - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270732] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256684] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256684] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256684] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271657] {CVE-2026-93288} - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254282] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-263292] {CVE-2026-89479} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254357] {CVE-2026-74588} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222954] {CVE-2026-52935} - powerpc/pseries: pci - logic bug (Mamatha Inamdar) [RHEL-240146] - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228} - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899] {CVE-2026-90036} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680] {CVE-2026-72262} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641} - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781] {CVE-2026-74583} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916] {CVE-2026-68377} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - [rt] build kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 [RHEL-53529] - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071} - [rt] build kernel-rt-4.18.0-553.21.1.rt7.362.el8_10 [RHEL-53529] - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874] - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558} - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441} - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904} - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322} - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246} - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008} - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228} - [rt] build kernel-rt-4.18.0-553.20.1.rt7.361.el8_10 [RHEL-53529] - KVM: arm64: Disassociate vcpus from redistributor region on teardown (Shaoqin Huang) [RHEL-48417] {CVE-2024-40989} - devres: Fix memory leakage caused by driver API devm_free_percpu() (CKI Backport Bot) [RHEL-55597] {CVE-2024-43871} - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (Izabela Bakollari) [RHEL-26680] {CVE-2024-26600} - nvmet-fc: avoid deadlock on delete association path (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - nvmet-fc: release reference on target port (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - ACPI: LPIT: Avoid u32 multiplication overflow (Mark Langsdorf) [RHEL-37062] {CVE-2023-52683} - sched/deadline: Fix task_struct reference leak (Phil Auld) [RHEL-50904] {CVE-2024-41023} - nfsd: fix crash on LOCKT on reexported NFSv3 (Benjamin Coddington) [RHEL-31515] - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path (CKI Backport Bot) [RHEL-26570] {CVE-2024-26595} - mlxsw: spectrum_acl_tcam: Move devlink param to TCAM code (Ivan Vecera) [RHEL-26570] {CVE-2024-26595} - ACPI: extlog: fix NULL pointer dereference check (Mark Langsdorf) [RHEL-29110] {CVE-2023-52605} - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() (Mark Langsdorf) [RHEL-33198] {CVE-2024-26894} - mm: prevent derefencing NULL ptr in pfn_section_valid() (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - mm, kmsan: fix infinite recursion due to RCU critical section (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - cipso: make cipso_v4_skbuff_delattr() fully remove the CIPSO options (Ondrej Mosnacek) [RHEL-30904] - cipso: fix total option length computation (Ondrej Mosnacek) [RHEL-30904] - ext4: do not create EA inode under buffer lock (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: check the return value of ext4_xattr_inode_dec_ref() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (Carlos Maiolino) [RHEL-48507] {CVE-2024-40998} - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - [rt] build kernel-rt-4.18.0-553.19.1.rt7.360.el8_10 [RHEL-53529] - drm/i915/vma: Fix UAF on destroy against retire race (Mika Penttilä) [RHEL-35222] {CVE-2024-26939} - RHEL-48620 (Kenneth Yin) [RHEL-48620] - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (CKI Backport Bot) [RHEL-42721] {CVE-2024-26855} - net: usb: asix: do not force pause frames support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix "can't send until first packet is send" issue (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix modprobe "sysfs: cannot create duplicate filename" (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: add proper error handling of usb read errors (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix wrong return value in asix_check_host_enable() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix uninit-value in asix_mdio_read() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: fix boolconv.cocci warnings (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: do not call phy_disconnect() for ax88178 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: move embedded PHY detection as early as possible (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix uninit value bugs (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add missing stop (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: suspend PHY on driver probe (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: manage PHY PM from MAC (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: add error handling for asix_mdio_* functions (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add phylib support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: refactor asix_read_phy_addr() and handle errors on return (Ken Cox) [RHEL-28108] {CVE-2021-47101} - SUNRPC: always free ctxt when freeing deferred request (Jay Shin) [RHEL-40936] - SUNRPC: double free xprt_ctxt while still in use (Jay Shin) [RHEL-40936] - SUNRPC: Remove svc_rqst::rq_xprt_hlen (Jay Shin) [RHEL-40936] - SUNRPC: Remove dead code in svc_tcp_release_rqst() (Jay Shin) [RHEL-40936] - x86/bugs: Extend VMware Retbleed workaround to Nehalem & earlier CPUs (Waiman Long) [RHEL-48646] - wifi: iwlwifi: read txq->read_ptr under lock (Jose Ignacio Tornos Martinez) [RHEL-39797] {CVE-2024-36922} - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (John Meneghini) [RHEL-39908] {CVE-2024-36919} - nbd: always initialize struct msghdr completely (Ming Lei) [RHEL-29498] {CVE-2024-26638} - block: don't call rq_qos_ops->done_bio if the bio isn't tracked (Ming Lei) [RHEL-42151] {CVE-2021-47412} - nvmet: fix a possible leak when destroy a ctrl during qp establishment (Maurizio Lombardi) [RHEL-52013] {CVE-2024-42152} - ipv6: prevent NULL dereference in ip6_output() (Sabrina Dubroca) [RHEL-39912] {CVE-2024-36901} - ppp: reject claimed-as-LCP but actually malformed packets (Guillaume Nault) [RHEL-51052] {CVE-2024-41044} - leds: trigger: Unregister sysfs attributes before calling deactivate() (CKI Backport Bot) [RHEL-54834] {CVE-2024-43830} - crypto: bcm - Fix pointer arithmetic (cki-backport-bot) [RHEL-44108] {CVE-2024-38579} - scsi: qedf: Ensure the copied buf is NUL terminated (John Meneghini) [RHEL-44195] {CVE-2024-38559} - x86/bhi: Avoid warning in #DB handler due to BHI mitigation (Waiman Long) [RHEL-53657] {CVE-2024-42240} - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (CKI Backport Bot) [RHEL-47529] {CVE-2024-40901} - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (CKI Backport Bot) [RHEL-39843] {CVE-2024-36902} - net: usb: ax88179_178a: improve link status logs (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: improve reset check (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: fix link status when link is set to down/up (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: avoid writing the mac address before first reading (Jose Ignacio Tornos Martinez) [RHEL-45167] - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - media: cec: cec-api: add locking in cec_release() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid confusing "transmit timed out" message (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid recursive cec_claim_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: remove length check of Timer Status (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: count low-drive, error and arb-lost conditions (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add note about *_from_edid() function usage in drm (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_unconfigured() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_nb_transmit_canceled() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: don't set last_initiator if tx in progress (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: disable adapter in cec_devnode_unregister (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: not all messages were passed on when monitoring (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add support for Absolute Volume Control (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: log when claiming LA fails unexpectedly (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: drop activate_cnt, use state info instead (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: reconfigure if the PA changes during configuration (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: fix is_configuring state (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: stop trying LAs on CEC_TX_STATUS_TIMEOUT (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't unconfigure if already unconfigured (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add optional adap_configured callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add xfer_timeout_ms field (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: use call_op and check for !unregistered (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix interrupt en/disable handling (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: drop unused 'enabled' field from struct cec_pin (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix off-by-one SFT check (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: rename timer overrun variables (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: correctly pass on reply results (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: abort if the current transmit was canceled (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: call enable_adap on s_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: media/cec.h: document cec_adapter fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix a deadlock situation (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: safely unhook lists in cec_data (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: copy sequence field for the reply (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix trivial style warnings (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: add 'unregistered' checks (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't use flush_scheduled_work() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: Use fallthrough pseudo-keyword (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: remove unused waitq and phys_addrs fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: silence shift wrapping warning in __cec_s_log_addrs() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: move the core to a separate directory (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - net/iucv: Avoid explicit cpumask var allocation on stack (CKI Backport Bot) [RHEL-51631] {CVE-2024-42094} - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (Dick Kennedy) [RHEL-40400] - KVM: selftests: Make hyperv_clock require TSC based system clocksource (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Run clocksource dependent tests with hyperv_clocksource_tsc_page too (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Use generic sys_clocksource_is_tsc() in vmx_nested_tsc_scaling_test (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Generalize check_clocksource() from kvm_clock_test (Vitaly Kuznetsov) [RHEL-19027] - firmware: cs_dsp: Return error if block header overflows file (CKI Backport Bot) [RHEL-53646] {CVE-2024-42238} - firmware: cs_dsp: Validate payload length before processing block (CKI Backport Bot) [RHEL-53638] {CVE-2024-42237} - mm, slub: fix potential memoryleak in kmem_cache_open() (Waiman Long) [RHEL-38404] {CVE-2021-47466} - slub: don't panic for memcg kmem cache creation failure (Waiman Long) [RHEL-38404] {CVE-2021-47466} - wifi: ath11k: fix htt pktlog locking (Jose Ignacio Tornos Martinez) [RHEL-38317] {CVE-2023-52800} - wifi: ath11k: fix dfs radar event locking (Jose Ignacio Tornos Martinez) [RHEL-38165] {CVE-2023-52798} - lib/generic-radix-tree.c: Don't overflow in peek() (Waiman Long) [RHEL-37737] {CVE-2021-47432} - include/linux/generic-radix-tree.h: replace kernel.h with the necessary inclusions (Waiman Long) [RHEL-37737] {CVE-2021-47432} - EDAC/i10nm: Skip the absent memory controllers (Aristeu Rozanski) [RHEL-43236] - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (John Meneghini) [RHEL-38197] {CVE-2023-52809} - gfs2: Fix potential glock use-after-free on unmount (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: simplify gdlm_put_lock with out_free label (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: Remove ill-placed consistency check (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - nvme-fc: do not wait in vain when unloading module (Ewan D. Milne) [RHEL-33083] {CVE-2024-26846} - HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts (CKI Backport Bot) [RHEL-49698] {CVE-2022-48866} - scsi: qedf: Set qed_slowpath_params to zero before use (John Meneghini) [RHEL-9797] - scsi: qedf: Wait for stag work during unload (John Meneghini) [RHEL-9797] - scsi: qedf: Don't process stag work during unload and recovery (John Meneghini) [RHEL-9797] - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - mm: avoid overflows in dirty throttling logic (Audra Mitchell) [RHEL-51840] {CVE-2024-42131} - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - ACPI: fix NULL pointer dereference (Mark Langsdorf) [RHEL-37897] {CVE-2021-47289} - [rt] build kernel-rt-4.18.0-553.18.1.rt7.359.el8_10 [RHEL-53529] - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING (Ewan D. Milne) [RHEL-39805] {CVE-2024-36920} - tun: limit printing rate when illegal packet received by tun dev (Jon Maloy) [RHEL-35046] {CVE-2024-27013} - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu/mes: fix use-after-free issue (Michel Dänzer) [RHEL-44043] {CVE-2024-38581} - drm/amdgpu: Fix the null pointer when load rlc firmware (Michel Dänzer) [RHEL-30603] {CVE-2024-26649} - drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (Michel Dänzer) [RHEL-35160] {CVE-2024-27042} - net/sched: Fix UAF when resolving a clash (Xin Long) [RHEL-51014] {CVE-2024-41040} - tcp_metrics: validate source addr length (Guillaume Nault) [RHEL-52025] {CVE-2024-42154} - NFSv4/pnfs: Fix a use-after-free bug in open (Benjamin Coddington) [RHEL-35508] - NFSv4: Don't hold the layoutget locks across multiple RPC calls (Benjamin Coddington) [RHEL-35508] - scsi: qedf: Make qedf_execute_tmf() non-preemptible (John Meneghini) [RHEL-51799] {CVE-2024-42124} - Input: elantech - fix stack out of bound access in elantech_change_report_id() (CKI Backport Bot) [RHEL-41938] {CVE-2021-47097} - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (CKI Backport Bot) [RHEL-28982] {CVE-2023-52478} - drm/radeon: fix UBSAN warning in kv_dpm.c (CKI Backport Bot) [RHEL-48399] {CVE-2024-40988} - usb: core: Don't hold the device lock while sleeping in do_proc_control() (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - USB: core: Make do_proc_control() and do_proc_bulk() killable (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - scsi: qedi: Fix crash while reading debugfs attribute (CKI Backport Bot) [RHEL-48327] {CVE-2024-40978} - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CKI Backport Bot) [RHEL-48309] {CVE-2024-40977} - net: tcp: accept old ack during closing (Jamie Bainbridge) [RHEL-52433] - wifi: iwlwifi: mvm: don't read past the mfuart notifcation (CKI Backport Bot) [RHEL-48016] {CVE-2024-40941} - net/iucv: fix use after free in iucv_sock_close() (Mete Durlu) [RHEL-53988] - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (CKI Backport Bot) [RHEL-47908] {CVE-2024-40929} - Input: aiptek - properly check endpoint type (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - use descriptors of current altsetting (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - fix endpoint sanity check (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB (CKI Backport Bot) [RHEL-52373] {CVE-2024-42226} - wifi: mt76: replace skb_put with skb_put_zero (CKI Backport Bot) [RHEL-52366] {CVE-2024-42225} - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (CKI Backport Bot) [RHEL-47776] {CVE-2024-40912} - wifi: cfg80211: Lock wiphy in cfg80211_get_station (CKI Backport Bot) [RHEL-47758] {CVE-2024-40911} - VMCI: Use struct_size() in kmalloc() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() (Steve Best) [RHEL-37325] {CVE-2024-35944} - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values (Jose Ignacio Tornos Martinez) [RHEL-51761] {CVE-2024-42114} - usb: atm: cxacru: fix endpoint checking in cxacru_bind() (CKI Backport Bot) [RHEL-51442] {CVE-2024-41097} - nfs: handle error of rpc_proc_register() in init_nfs_fs() (Scott Mayhew) [RHEL-39904] {CVE-2024-36939} - drm/radeon: check bo_va->bo is non-NULL before using it (CKI Backport Bot) [RHEL-51184] {CVE-2024-41060} - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). (CKI Backport Bot) [RHEL-51027] {CVE-2024-41041} - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (CKI Backport Bot) [RHEL-50961] {CVE-2024-41035} - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). (CKI Backport Bot) [RHEL-44408] {CVE-2024-37356} - tcp: avoid too many retransmit packets (Florian Westphal) [RHEL-48627] {CVE-2024-41007} - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() (Florian Westphal) [RHEL-48627] - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Florian Westphal) [RHEL-48627] - tcp: refactor tcp_retransmit_timer() (Florian Westphal) [RHEL-48627] - tcp: exit if nothing to retransmit on RTO timeout (Florian Westphal) [RHEL-48627] - netfilter: nf_tables: Reject tables of unsupported family (Florian Westphal) [RHEL-21418] {CVE-2023-6040} - [rt] build kernel-rt-4.18.0-553.17.1.rt7.358.el8_10 [RHEL-53529] - kyber: fix out of bounds access when preempted (Ming Lei) [RHEL-27258] {CVE-2021-46984} - vfs: don't mod negative dentry count when on shrinker list (Brian Foster) [RHEL-35874] - fs/dcache: Re-use value stored to dentry->d_flags instead of re-reading (Brian Foster) [RHEL-35874] - fbmem: Do not delete the mode that is still in use (CKI Backport Bot) [RHEL-37796] {CVE-2021-47338} - netpoll: Fix race condition in netpoll_owner_active (CKI Backport Bot) [RHEL-49361] {CVE-2024-41005} - firmware: arm_scpi: Fix string overflow in SCPI genpd driver (Mark Salter) [RHEL-43702] {CVE-2021-47609} - ipv6: prevent possible NULL dereference in rt6_probe() (Guillaume Nault) [RHEL-48149] {CVE-2024-40960} - HID: i2c-hid-of: fix NULL-deref on failed power up (CKI Backport Bot) [RHEL-31598] {CVE-2024-26717} - cpufreq: amd-pstate: fix memory leak on CPU EPP exit (CKI Backport Bot) [RHEL-48489] {CVE-2024-40997} - x86/mm/pat: fix VM_PAT handling in COW mappings (Chris von Recklinghausen) [RHEL-37258] {CVE-2024-35877} - PCI/PM: Drain runtime-idle callbacks before driver removal (Myron Stowe) [RHEL-42937] {CVE-2024-35809} - PCI: Drop pci_device_remove() test of pci_dev->driver (Myron Stowe) [RHEL-42937] {CVE-2024-35809} - drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() (Mika Penttilä) [RHEL-26909] {CVE-2023-52470} - USB: core: Fix hang in usb_kill_urb by adding memory barriers (Desnes Nunes) [RHEL-43979] {CVE-2022-48760} - cifs: fix bad fids sent over wire (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB311_posix_mkdir (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB2_tcon (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB2_open (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB2_ioctl (Paulo Alcantara) [RHEL-52517] - selftests: forwarding: devlink_lib: Wait for udev events after reloading (Mark Langsdorf) [RHEL-47642] {CVE-2024-39501} - drivers: core: synchronize really_probe() and dev_uevent() (Mark Langsdorf) [RHEL-47642] {CVE-2024-39501} - udp: do not accept non-tunnel GSO skbs landing in a tunnel (Xin Long) [RHEL-42997] {CVE-2024-35884} - filelock: Remove locks reliably when fcntl/close race is detected (Bill O'Donnell) [RHEL-50170] {CVE-2024-41012} - Input: add bounds checking to input_set_capability() (Benjamin Tissoires) [RHEL-21413] {CVE-2022-48619} - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() (CKI Backport Bot) [RHEL-48130] {CVE-2024-40959} - blk-cgroup: fix list corruption from reorder of WRITE ->lqueued (Ming Lei) [RHEL-33695] - blk-cgroup: fix list corruption from resetting io stat (Ming Lei) [RHEL-33695] - net: do not leave a dangling sk pointer, when socket creation fails (CKI Backport Bot) [RHEL-48060] {CVE-2024-40954} - perf/x86/lbr: Filter vsyscall addresses (Michael Petlan) [RHEL-28991] {CVE-2023-52476} - vmci: prevent speculation leaks by sanitizing event in event_deliver() (CKI Backport Bot) [RHEL-47678] {CVE-2024-39499} - serial: core: fix transmit-buffer reset and memleak (Steve Best) [RHEL-38731] {CVE-2021-47527} - powerpc/pseries: Whitelist dtl slub object for copying to userspace (Mamatha Inamdar) [RHEL-51236] {CVE-2024-41065} - powerpc/eeh: avoid possible crash when edev->pdev changes (Mamatha Inamdar) [RHEL-51220] {CVE-2024-41064} - x86: stop playing stack games in profile_pc() (Steve Best) [RHEL-51643] {CVE-2024-42096} - mptcp: ensure snd_una is properly initialized on connect (Florian Westphal) [RHEL-47933 RHEL-47934] {CVE-2024-40931} - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet (CKI Backport Bot) [RHEL-47492] {CVE-2024-39506} - tun: add missing verification for short frame (Patrick Talbert) [RHEL-50194] {CVE-2024-41091} - tap: add missing verification for short frame (Patrick Talbert) [RHEL-50279] {CVE-2024-41090} - usb-storage: alauda: Check whether the media is initialized (Desnes Nunes) [RHEL-43708] {CVE-2024-38619} - usb-storage: alauda: Fix uninit-value in alauda_check_media() (Desnes Nunes) [RHEL-43708] {CVE-2024-38619} - hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37723] {CVE-2021-47384} - block: fix that util can be greater than 100% (Ming Lei) [RHEL-23074] - block: support to account io_ticks precisely (Ming Lei) [RHEL-23074] - watchdog: Fix possible use-after-free by calling del_timer_sync() (Steve Best) [RHEL-38795] {CVE-2021-47321} - hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37719] {CVE-2021-47385} - mlxsw: spectrum: Protect driver from buggy firmware (CKI Backport Bot) [RHEL-42245] {CVE-2021-47560} - mlxsw: Verify the accessed index doesn't exceed the array length (CKI Backport Bot) [RHEL-42245] {CVE-2021-47560} - dm: call the resume method on internal suspend (Benjamin Marzinski) [RHEL-41835] {CVE-2024-26880} - tty: Fix out-of-bound vmalloc access in imageblit (Steve Best) [RHEL-37727] {CVE-2021-47383} - hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37715] {CVE-2021-47386} - hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs (Steve Best) [RHEL-37710] {CVE-2021-47393} - nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells (Steve Best) [RHEL-38436] {CVE-2021-47497} - driver core: auxiliary bus: Fix memory leak when driver_register() fail (Steve Best) [RHEL-37901] {CVE-2021-47287} - phylib: fix potential use-after-free (cki-backport-bot) [RHEL-43764] {CVE-2022-48754} - ptp: Fix possible memory leak in ptp_clock_register() (Hangbin Liu) [RHEL-38424] {CVE-2021-47455} - NFSv4: Fix memory leak in nfs4_set_security_label (CKI Backport Bot) [RHEL-51315] {CVE-2024-41076} - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER (CKI Backport Bot) [RHEL-51618] {CVE-2024-42090} - ftruncate: pass a signed offset (CKI Backport Bot) [RHEL-51598] {CVE-2024-42084} - af_unix: Fix garbage collector racing against connect() (Felix Maurer) [RHEL-34225] {CVE-2024-26923} - virtio-net: Add validation for used length (Laurent Vivier) [RHEL-42080] {CVE-2021-47352} - net: fix possible store tearing in neigh_periodic_work() (Antoine Tenart) [RHEL-42359] {CVE-2023-52522} - tunnels: fix out of bounds access when building IPv6 PMTU error (Antoine Tenart) [RHEL-41823] {CVE-2024-26665} - vt_ioctl: fix array_index_nospec in vt_setactivate (John W. Linville) [RHEL-49141] {CVE-2022-48804} - Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() (CKI Backport Bot) [RHEL-38302] {CVE-2023-52840} - netns: Make get_net_ns() handle zero refcount net (Antoine Tenart) [RHEL-48105] {CVE-2024-40958} - tracing: Ensure visibility when inserting an element into tracing_map (Michael Petlan) [RHEL-30457] {CVE-2024-26645} - KVM: s390: fix LPSWEY handling (CKI Backport Bot) [RHEL-50072] - firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files (CKI Backport Bot) [RHEL-51144] {CVE-2024-41056} - SUNRPC: Fix a race to wake a sync task (Benjamin Coddington) [RHEL-11843] - firmware: cs_dsp: Fix overflow checking of wmfw header (CKI Backport Bot) [RHEL-50999] {CVE-2024-41039} - firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers (CKI Backport Bot) [RHEL-50987] {CVE-2024-41038} - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (Xin Long) [RHEL-48471] {CVE-2024-40995} - net: fix out-of-bounds access in ops_init (Xin Long) [RHEL-43185] {CVE-2024-36883} - x86/mce/therm_throt: Undo thermal polling properly on CPU offline (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Do not access uninitialized therm_work (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Mark throttle_active_work() as __maybe_unused (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Mask out read-only and reserved MSR bits (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Optimize notifications of thermal throttle (Steve Best) [RHEL-45310] - jiffies: add utility function to calculate delta in ms (Steve Best) [RHEL-45310] - x86/mce: Lower throttling MCE messages' priority to warning (Steve Best) [RHEL-45310] - dmaengine: idxd: Fix oops during rmmod on single-CPU platforms (Eder Zulian) [RHEL-37361] {CVE-2024-35989} - xfs: don't walk off the end of a directory data block (CKI Backport Bot) [RHEL-50879] {CVE-2024-41013} - xfs: add bounds checking to xlog_recover_process_data (CKI Backport Bot) [RHEL-50856] {CVE-2024-41014} - dm-crypt: limit the size of encryption requests (Benjamin Marzinski) [RHEL-29330] - netfilter: flowtable: remove nf_ct_l4proto_find() call (Florian Westphal) [RHEL-49589] - [rt] build kernel-rt-4.18.0-553.16.1.rt7.357.el8_10 [RHEL-44553] - x86/bhi: Fix incorrect CLEAR_BRANCH_HISTORY position in entry_INT80_compat (Waiman Long) [RHEL-50648] - [rt] build kernel-rt-4.18.0-553.15.1.rt7.356.el8_10 [RHEL-44553] - Revert "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-44613] - ionic: fix use after netif_napi_del() (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - ionic: clean interrupt before enabling queue to avoid credit race (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change (CKI Backport Bot) [RHEL-49321] {CVE-2021-47624} - xhci: Handle TD clearing for multiple streams case (CKI Backport Bot) [RHEL-47882] {CVE-2024-40927} - net: openvswitch: Fix Use-After-Free in ovs_ct_exit (cki-backport-bot) [RHEL-36362] {CVE-2024-27395} - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: fix vlan use-after-free (cki-backport-bot) [RHEL-43721] {CVE-2024-36979} - irqchip/gic-v3-its: Prevent double free on error (Charles Mirabile) [RHEL-37022] {CVE-2024-35847} - irqchip/gic-v3-its: Fix potential VPE leak on error (Charles Mirabile) [RHEL-37744] {CVE-2021-47373} - i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() (Charles Mirabile) [RHEL-34735] {CVE-2022-48632} - iommu/dma: fix zeroing of bounce buffer padding used by untrusted devices (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: remove alloc_size argument to swiotlb_tbl_map_single() (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: fix swiotlb_bounce() to do partial sync's correctly (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Reinstate page-alignment for mappings >= PAGE_SIZE (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix alignment checks when both allocation and DMA masks are present (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix double-allocation of slots due to broken alignment handling (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (cki-backport-bot) [RHEL-44441] {CVE-2024-31076} - [rt] build kernel-rt-4.18.0-553.14.1.rt7.355.el8_10 [RHEL-44553] - s390/qeth: Fix kernel panic after setting hsuid (Mete Durlu) [RHEL-49754] - perf/core: Protect event sibling list locking against interrupt inversion (Daniel Vacek) [RHEL-31798] - vt: fix unicode buffer corruption when deleting characters (Steve Best) [RHEL-36936] {CVE-2024-35823} - cifs: translate network errors on send to -ECONNABORTED (Paulo Alcantara) [RHEL-36754] - xfs: don't block in busy flushing when freeing extents (Brian Foster) [RHEL-7984] - xfs: allow extent free intents to be retried (Brian Foster) [RHEL-7984] - xfs: pass alloc flags through to xfs_extent_busy_flush() (Brian Foster) [RHEL-7984] - xfs: use deferred frees for btree block freeing (Brian Foster) [RHEL-7984] - xfs: fix bounds check in xfs_defer_agfl_block() (Brian Foster) [RHEL-7984] - xfs: validate block number being freed before adding to xefi (Brian Foster) [RHEL-7984] - xfs: rename xfs_bmap_add_free to xfs_free_extent_later (Brian Foster) [RHEL-7984] - usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (Desnes Nunes) [RHEL-36803] {CVE-2024-35790} - stm class: Fix a double free in stm_register_device() (Steve Best) [RHEL-44514] {CVE-2024-38627} - s390/qeth: Fix potential loss of L3-IP@ in case of network issues (Mete Durlu) [RHEL-49755] - tls: fix missing memory barrier in tls_init (cki-backport-bot) [RHEL-44471] {CVE-2024-36489} - xfs: fix log recovery buffer allocation for the legacy h_size fixup (Bill O'Donnell) [RHEL-46473] {CVE-2024-39472} - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: use __for_each_thread() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - exit: Use the correct exit_code in /proc/<pid>/stat (Brian Foster) [RHEL-31562] {CVE-2024-26686} - scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool (Ewan D. Milne) [RHEL-38283] {CVE-2023-52811} - scsi: qla2xxx: Fix double free of fcport (Ewan D. Milne) [RHEL-39549] {CVE-2024-26929} - scsi: qla2xxx: Fix double free of the ha->vp_map pointer (Ewan D. Milne) [RHEL-39549] {CVE-2024-26930} - scsi: qla2xxx: Fix command flush on cable pull (Ewan D. Milne) [RHEL-39549] {CVE-2024-26931} - [rt] build kernel-rt-4.18.0-553.13.1.rt7.354.el8_10 [RHEL-44553] - redhat: remove handling of deleted rhdocs/ directory from genspec.sh (Denys Vlasenko) - x86/bugs: Fix BHI retpoline check (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI handling of RRSBA (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr' (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI documentation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix return type of spectre_bhi_state() (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Make CONFIG_SPECTRE_BHI_ON the default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Mitigate KVM by default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add BHI mitigation knob (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Enumerate Branch History Injection (BHI) bug (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Define SPEC_CTRL_BHI_DIS_S (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add support for clearing branch history at syscall entry (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file (Waiman Long) [RHEL-28202] - perf/x86/amd/lbr: Use freeze based on availability (Waiman Long) [RHEL-28202] - Documentation/kernel-parameters: Add spec_rstack_overflow to mitigations=off (Waiman Long) [RHEL-28202] - KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace (Waiman Long) [RHEL-28202] - x86/bugs: Reset speculation control settings on init (Waiman Long) [RHEL-28202] - KVM: x86: Update KVM-only leaf handling to allow for 100% KVM-only leafs (Waiman Long) [RHEL-28202] - KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest (Waiman Long) [RHEL-28202] - mptcp: ensure snd_nxt is properly initialized on connect (Davide Caratti) [RHEL-39865] {CVE-2024-36889} - powerpc/pseries: Enforce hcall result buffer validity and size (Mamatha Inamdar) [RHEL-48291] {CVE-2024-40974} - wifi: mac80211: fix potential key use-after-free (Jose Ignacio Tornos Martinez) [RHEL-28007] {CVE-2023-52530} - cppc_cpufreq: Fix possible null pointer dereference (Mark Langsdorf) [RHEL-44137] {CVE-2024-38573} - net/sched: act_mirred: use the backlog for mirred ingress (Davide Caratti) [RHEL-31718] {CVE-2024-26740} - vfio/pci: Lock external INTx masking ops (Alex Williamson) [RHEL-31922] {CVE-2024-26810} - net: sched: sch_multiq: fix possible OOB write in multiq_tune() (Davide Caratti) [RHEL-43464] {CVE-2024-36978} - tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized (Guillaume Nault) [RHEL-37850] {CVE-2021-47304} - pstore/ram: Fix crash when setting number of cpus to an odd number (Lenny Szubowicz) [RHEL-29471] {CVE-2023-52619} - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node (Jocelyn Falempe) [RHEL-37101] {CVE-2023-52662} - drm/vmwgfx: Fix the lifetime of the bo cursor memory (Jocelyn Falempe) [RHEL-36962] {CVE-2024-35810} - drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed (Jocelyn Falempe) [RHEL-34987] {CVE-2024-26940} - drm/vmwgfx: Unmap the surface before resetting it on a plane state (Jocelyn Falempe) [RHEL-35217] {CVE-2023-52648} - drm/vmwgfx: Fix invalid reads in fence signaled events (Jocelyn Falempe) [RHEL-40010] {CVE-2024-36960} - block: Fix wrong offset in bio_truncate() (Ming Lei) [RHEL-43782] {CVE-2022-48747} - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CKI Backport Bot) [RHEL-46913] {CVE-2024-39487} - net: fix __dst_negative_advice() race (Xin Long) [RHEL-41183] {CVE-2024-36971} - igc: avoid returning frame twice in XDP_REDIRECT (Corinna Vinschen) [RHEL-33264] {CVE-2024-26853} - mac802154: fix llsec key resources release in mac802154_llsec_key_del (Steve Best) [RHEL-34967] {CVE-2024-26961} - cpufreq: exit() callback is optional (Mark Langsdorf) [RHEL-43840] {CVE-2024-38615} - cifs: prevent infinite recursion in CIFSGetDFSRefer() (Paulo Alcantara) [RHEL-34672] - cifs: lock chan_lock outside match_session (Paulo Alcantara) [RHEL-34672] - smb3: workaround negprot bug in some Samba servers (Paulo Alcantara) [RHEL-34672] - smb3: use netname when available on secondary channels (Paulo Alcantara) [RHEL-34672] - smb3: fix empty netname context on secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: populate empty hostnames for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: always iterate smb sessions using primary channel (Paulo Alcantara) [RHEL-34672] - cifs: Fix connections leak when tlink setup failed (Paulo Alcantara) [RHEL-34672] - cifs: Fix memory leak when build ntlmssp negotiate blob failed (Paulo Alcantara) [RHEL-34672] - cifs: always initialize struct msghdr smb_msg completely (Paulo Alcantara) [RHEL-34672] - cifs: don't send down the destination address to sendmsg for a SOCK_STREAM (Paulo Alcantara) [RHEL-34672] - cifs: revalidate mapping when doing direct writes (Paulo Alcantara) [RHEL-34672] - cifs: skip extra NULL byte in filenames (Paulo Alcantara) [RHEL-34672] - cifs: list_for_each() -> list_for_each_entry() (Paulo Alcantara) [RHEL-34672] - smb2: small refactor in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - cifs: Fix crash on unload of cifs_arc4.ko (Paulo Alcantara) [RHEL-34672] - cifs: remove check of list iterator against head past the loop body (Paulo Alcantara) [RHEL-34672] - cifs: fix reconnect on smb3 mount types (Paulo Alcantara) [RHEL-34672] - cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (Paulo Alcantara) [RHEL-34672] - cifs: skip trailing separators of prefix paths (Paulo Alcantara) [RHEL-34672] - cifs: fix ntlmssp on old servers (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL ptr dereference in refresh_mounts() (Paulo Alcantara) [RHEL-34672] - cifs: do not skip link targets when an I/O fails (Paulo Alcantara) [RHEL-34672] - cifs: fix confusing unneeded warning message on smb2.1 and earlier (Paulo Alcantara) [RHEL-34672] - smb3: fix snapshot mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix workstation_name for multiuser mounts (Paulo Alcantara) [RHEL-34672] - cifs: alloc_path_with_tree_prefix: do not append sep. if the path is empty (Paulo Alcantara) [RHEL-34672] - cifs: free ntlmsspblob allocated in negotiate (Paulo Alcantara) [RHEL-34672] - cifs: avoid use of dstaddr as key for fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: add server conn_id to fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: fix missed refcounting of ipc tcon (Paulo Alcantara) [RHEL-34672] - smb2: clarify rc initialization in smb2_reconnect (Paulo Alcantara) [RHEL-34672] - cifs: populate server_hostname for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should be set on new server (Paulo Alcantara) [RHEL-34672] - cifs: introduce cifs_ses_mark_for_reconnect() helper (Paulo Alcantara) [RHEL-34672] - cifs: protect srv_count with cifs_tcp_ses_lock (Paulo Alcantara) [RHEL-34672] - cifs: move debug print out of spinlock (Paulo Alcantara) [RHEL-34672] - cifs: do not duplicate fscache cookie for secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: connect individual channel servers to primary channel server (Paulo Alcantara) [RHEL-34672] - cifs: protect session channel fields with chan_lock (Paulo Alcantara) [RHEL-34672] - cifs: do not negotiate session if session already exists (Paulo Alcantara) [RHEL-34672] - smb3: do not setup the fscache_super_cookie until fsinfo initialized (Paulo Alcantara) [RHEL-34672] - cifs: fix potential use-after-free bugs (Paulo Alcantara) [RHEL-34672] - cifs: release lock earlier in dequeue_mid error case (Paulo Alcantara) [RHEL-34672] - smb3: remove trivial dfs compile warning (Paulo Alcantara) [RHEL-34672] - cifs: support nested dfs links over reconnect (Paulo Alcantara) [RHEL-34672] - cifs: for compound requests, use open handle if possible (Paulo Alcantara) [RHEL-34672] - cifs: split out dfs code from cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant (Paulo Alcantara) [RHEL-34672] - cifs: introduce new helper for cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: fix print of hdr_flags in dfscache_proc_show() (Paulo Alcantara) [RHEL-34672] - cifs: send workstation name during ntlmssp session setup (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should not share socket with future sessions (Paulo Alcantara) [RHEL-34672] - smb3: add dynamic trace points for socket connection (Paulo Alcantara) [RHEL-34672] - cifs: Move SMB2_Create definitions to the shared area (Paulo Alcantara) [RHEL-34672] - cifs: Move more definitions into the shared area (Paulo Alcantara) [RHEL-34672] - cifs: move NEGOTIATE_PROTOCOL definitions out into the common area (Paulo Alcantara) [RHEL-34672] - cifs: Create a new shared file holding smb2 pdu definitions (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect check for null pointer in header_assemble (Paulo Alcantara) [RHEL-34672] - smb3: correct server pointer dereferencing check to be more consistent (Paulo Alcantara) [RHEL-34672] - cifs: Deal with some warnings from W=1 (Paulo Alcantara) [RHEL-34672] - cifs: fix a sign extension bug (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect kernel doc comments (Paulo Alcantara) [RHEL-34672] - cifs: remove pathname for file from SPDX header (Paulo Alcantara) [RHEL-34672] - cifs: move SMB FSCTL definitions to common code (Paulo Alcantara) [RHEL-34672] - cifs: rename cifs_common to smbfs_common (Paulo Alcantara) [RHEL-34672] - cifs: update FSCTL definitions (Paulo Alcantara) [RHEL-34672] - cifs: cifs_md4 convert to SPDX identifier (Paulo Alcantara) [RHEL-34672] - cifs: create a MD4 module and switch cifs.ko to use it (Paulo Alcantara) [RHEL-34672] - cifs: fork arc4 and create a separate module for it for cifs and other users (Paulo Alcantara) [RHEL-34672] - smb3: fix posix extensions mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix wrong release in sess_alloc_buffer() failed path (Paulo Alcantara) [RHEL-34672] - CIFS: Fix a potencially linear read overflow (Paulo Alcantara) [RHEL-34672] - cifs: use the correct max-length for dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: create sd context must be a multiple of 8 (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp sessions of dfs connections (Paulo Alcantara) [RHEL-34672] - cifs: added WARN_ON for all the count decrements (Paulo Alcantara) [RHEL-34672] - cifs: fix missing null session check in mount (Paulo Alcantara) [RHEL-34672] - cifs: handle reconnect of tcon when there is no cached dfs referral (Paulo Alcantara) [RHEL-34672] - cifs: fix the out of range assignment to bit fields in parse_server_interfaces (Paulo Alcantara) [RHEL-34672] - smb3: fix typo in header file (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: Add support for negotiating signing algorithm (Paulo Alcantara) [RHEL-34672] - cifs: prevent NULL deref in cifs_compose_mount_options() (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL dereference in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - smbdirect: missing rc checks while waiting for rdma events (Paulo Alcantara) [RHEL-34672] - cifs: Avoid field over-reading memcpy() (Paulo Alcantara) [RHEL-34672] - smb311: remove dead code for non compounded posix query info (Paulo Alcantara) [RHEL-34672] - cifs: fix SMB1 error path in cifs_get_file_info_unix (Paulo Alcantara) [RHEL-34672] - smb3: fix uninitialized value for port in witness protocol move (Paulo Alcantara) [RHEL-34672] - cifs: fix unneeded null check (Paulo Alcantara) [RHEL-34672] - cifs: use SPDX-Licence-Identifier (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in cifs_debug.c (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in smb2misc.c (Paulo Alcantara) [RHEL-34672] - cifs: missed ref-counting smb session in find (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp servers with dfs mounts (Paulo Alcantara) [RHEL-34672] - cifs: set a minimum of 2 minutes for refreshing dfs cache (Paulo Alcantara) [RHEL-34672] - cifs: Remove unused inline function is_sysvol_or_netlogon() (Paulo Alcantara) [RHEL-34672] - cifs: remove duplicated prototype (Paulo Alcantara) [RHEL-34672] - cifs: fix ipv6 formating in cifs_ses_add_channel (Paulo Alcantara) [RHEL-34672] - cifs: fix string declarations and assignments in tracepoints (Paulo Alcantara) [RHEL-34672] - cifs: fix memory leak in smb2_copychunk_range (Paulo Alcantara) [RHEL-34672] - SMB3: incorrect file id in requests compounded with open (Paulo Alcantara) [RHEL-34672] - smb3: if max_channels set to more than one channel request multichannel (Paulo Alcantara) [RHEL-34672] - smb3: do not attempt multichannel to server which does not support it (Paulo Alcantara) [RHEL-34672] - smb3: when mounting with multichannel include it in requested capabilities (Paulo Alcantara) [RHEL-34672] - cifs: simplify SWN code with dummy funcs instead of ifdefs (Paulo Alcantara) [RHEL-34672] - cifs: log mount errors using cifs_errorf() (Paulo Alcantara) [RHEL-34672] - cifs: switch build_path_from_dentry() to using dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: fix out-of-bound memory access when calling smb3_notify() at mount point (Paulo Alcantara) [RHEL-34672] - cifs: allocate buffer in the caller of build_path_from_dentry() (Paulo Alcantara) [RHEL-34672] - cifs: make build_path_from_dentry() return const char * (Paulo Alcantara) [RHEL-34672] - cifs: remove old dead code (Paulo Alcantara) [RHEL-34672] - fs: cifs: Remove repeated struct declaration (Paulo Alcantara) [RHEL-34672] - cifs: have cifs_fattr_to_inode() refuse to change type on live inode (Paulo Alcantara) [RHEL-34672] - cifs: have ->mkdir() handle race with another client sanely (Paulo Alcantara) [RHEL-34672] - do_cifs_create(): don't set ->i_mode of something we had not created (Paulo Alcantara) [RHEL-34672] - cifs: Silently ignore unknown oplock break handle (Paulo Alcantara) [RHEL-34672] - cifs: change noisy error message to FYI (Paulo Alcantara) [RHEL-34672] - cifs: print MIDs in decimal notation (Paulo Alcantara) [RHEL-34672] - cifs: minor simplification to smb2_is_network_name_deleted (Paulo Alcantara) [RHEL-34672] - TCON Reconnect during STATUS_NETWORK_NAME_DELETED (Paulo Alcantara) [RHEL-34672] - cifs: clarify hostname vs ip address in /proc/fs/cifs/DebugData (Paulo Alcantara) [RHEL-34672] - cifs: change confusing field serverName (to ip_addr) (Paulo Alcantara) [RHEL-34672] - cifs: Reformat DebugData and index connections by conn_id. (Paulo Alcantara) [RHEL-34672] - cifs: Identify a connection by a conn_id. (Paulo Alcantara) [RHEL-34672] - smb3: negotiate current dialect (SMB3.1.1) when version 3 or greater requested (Paulo Alcantara) [RHEL-34672] - smb3: Fix out-of-bounds bug in SMB2_negotiate() (Paulo Alcantara) [RHEL-34672] - fs/cifs: Simplify bool comparison. (Paulo Alcantara) [RHEL-34672] - fs/cifs: Assign boolean values to a bool variable (Paulo Alcantara) [RHEL-34672] - cifs: Avoid error pointer dereference (Paulo Alcantara) [RHEL-34672] - cifs: Re-indent cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Unlock on errors in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Delete a stray unlock in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Tracepoints and logs for tracing credit changes. (Paulo Alcantara) [RHEL-34672] - cifs: Fix some error pointers handling detected by static checker (Paulo Alcantara) [RHEL-34672] - smb3: remind users that witness protocol is experimental (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: do not log warning message if server doesn't populate salt (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: update comments clarifying SPNEGO info in negprot response (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot rsp (Paulo Alcantara) [RHEL-34672] - SMB3: avoid confusing warning message on mount to Azure (Paulo Alcantara) [RHEL-34672] - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (Nigel Croxon) [RHEL-46662] {CVE-2024-39476} - net: fix information leakage in /proc/net/ptype (Hangbin Liu) [RHEL-44000] {CVE-2022-48757} - usb: typec: ucsi: Limit read size on v1.2 (Desnes Nunes) [RHEL-37286] {CVE-2024-35924} - minmax: relax check to allow comparison between unsigned arguments and signed constants (Desnes Nunes) [RHEL-37286] - minmax: allow comparisons of 'int' against 'unsigned char/short' (Desnes Nunes) [RHEL-37286] - minmax: allow min()/max()/clamp() if the arguments have the same signedness. (Desnes Nunes) [RHEL-37286] - minmax: add umin(a, b) and umax(a, b) (Desnes Nunes) [RHEL-37286] - minmax: fix header inclusions (Desnes Nunes) [RHEL-37286] - minmax: clamp more efficiently by avoiding extra comparison (Desnes Nunes) [RHEL-37286] - minmax: sanity check constant bounds when clamping (Desnes Nunes) [RHEL-37286] - tracing: Define the is_signed_type() macro once (Desnes Nunes) [RHEL-37286] - linux/bits.h: fix compilation error with GENMASK (Desnes Nunes) [RHEL-37286] - x86/apic: Mask IOAPIC entries when disabling the local APIC (Lenny Szubowicz) [RHEL-18077] - userfaultfd: fix a race between writeprotect and exit_mmap() (Rafael Aquini) [RHEL-38410] {CVE-2021-47461} - mm: khugepaged: skip huge page collapse for special files (Waiman Long) [RHEL-38446] {CVE-2021-47491} - cachefiles: fix memory leak in cachefiles_add_cache() (Andrey Albershteyn) [RHEL-33109] {CVE-2024-26840} - drm/amd/display: Implement bounds check for stream encoder creation in DCN301 (Michel Dänzer) [RHEL-31429] {CVE-2024-26660} - net/mlx5: Discard command completions in internal error (Kamal Heib) [RHEL-44231] {CVE-2024-38555} - drm: Don't unref the same fb many times by mistake due to deadlock handling (CKI Backport Bot) [RHEL-29011] {CVE-2023-52486} - md: fix resync softlockup when bitmap size is less than array size (Nigel Croxon) [RHEL-43942] {CVE-2024-38598} - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation (Davide Caratti) [RHEL-39712] {CVE-2024-36017} - netfilter: nf_tables: discard table flag update with pending basechain deletion (Phil Sutter) [RHEL-37205] {CVE-2024-35897} - netfilter: nf_tables: reject table flag and netdev basechain updates (Phil Sutter) [RHEL-37205] - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (Ewan D. Milne) [RHEL-40172] {CVE-2024-36924} - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (Ewan D. Milne) [RHEL-40172] {CVE-2024-36952} - netfilter: nf_tables: fix memleak in map from abort path (Phil Sutter) [RHEL-35052] {CVE-2024-27011} - netfilter: nf_tables: reject new basechain after table flag update (Phil Sutter) [RHEL-37193] {CVE-2024-35900} - netfilter: nf_tables: flush pending destroy work before exit_net release (Phil Sutter) [RHEL-37197] {CVE-2024-35899} - netfilter: complete validation of user input (Phil Sutter) [RHEL-37210] - netfilter: validate user input for expected length (Phil Sutter) [RHEL-37210] {CVE-2024-35896} - netfilter: tproxy: bail out if IP has been disabled on the device (Phil Sutter) [RHEL-44363] {CVE-2024-36270} - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (Phil Sutter) [RHEL-44532] {CVE-2024-36286} - netfilter: nf_tables: do not compare internal table flags on updates (Phil Sutter) [RHEL-35114] {CVE-2024-27065} - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (Phil Sutter) [RHEL-35028] {CVE-2024-27019} - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (Phil Sutter) [RHEL-35024] {CVE-2024-27020} - netfilter: nf_tables: __nft_expr_type_get() selects specific family type (Phil Sutter) [RHEL-35024] - netfilter: conntrack: serialize hash resizes and cleanups (Phil Sutter) [RHEL-37703] {CVE-2021-47408} - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (Phil Sutter) [RHEL-34217] {CVE-2024-26925} - netfilter: nf_tables: release batch on table validation from abort path (Phil Sutter) [RHEL-34217] - ipvlan: add ipvlan_route_v6_outbound() helper (Davide Caratti) [RHEL-38319] {CVE-2023-52796} - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.23.1.rt7.364.el8_10 [RHEL-59541] - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002] - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924} - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042} - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070} - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898} - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301} - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976} - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540} - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284} - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857} - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924} - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983} - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854} - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936} - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093} - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961} - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880} - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244} - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984} - [rt] build kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 [RHEL-53529] - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071} - [rt] build kernel-rt-4.18.0-553.21.1.rt7.362.el8_10 [RHEL-53529] - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874] - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558} - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441} - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904} - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322} - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246} - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008} - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228} - [rt] build kernel-rt-4.18.0-553.20.1.rt7.361.el8_10 [RHEL-53529] - KVM: arm64: Disassociate vcpus from redistributor region on teardown (Shaoqin Huang) [RHEL-48417] {CVE-2024-40989} - devres: Fix memory leakage caused by driver API devm_free_percpu() (CKI Backport Bot) [RHEL-55597] {CVE-2024-43871} - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (Izabela Bakollari) [RHEL-26680] {CVE-2024-26600} - nvmet-fc: avoid deadlock on delete association path (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - nvmet-fc: release reference on target port (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - ACPI: LPIT: Avoid u32 multiplication overflow (Mark Langsdorf) [RHEL-37062] {CVE-2023-52683} - sched/deadline: Fix task_struct reference leak (Phil Auld) [RHEL-50904] {CVE-2024-41023} - nfsd: fix crash on LOCKT on reexported NFSv3 (Benjamin Coddington) [RHEL-31515] - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path (CKI Backport Bot) [RHEL-26570] {CVE-2024-26595} - mlxsw: spectrum_acl_tcam: Move devlink param to TCAM code (Ivan Vecera) [RHEL-26570] {CVE-2024-26595} - ACPI: extlog: fix NULL pointer dereference check (Mark Langsdorf) [RHEL-29110] {CVE-2023-52605} - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() (Mark Langsdorf) [RHEL-33198] {CVE-2024-26894} - mm: prevent derefencing NULL ptr in pfn_section_valid() (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - mm, kmsan: fix infinite recursion due to RCU critical section (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - cipso: make cipso_v4_skbuff_delattr() fully remove the CIPSO options (Ondrej Mosnacek) [RHEL-30904] - cipso: fix total option length computation (Ondrej Mosnacek) [RHEL-30904] - ext4: do not create EA inode under buffer lock (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: check the return value of ext4_xattr_inode_dec_ref() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (Carlos Maiolino) [RHEL-48507] {CVE-2024-40998} - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - [rt] build kernel-rt-4.18.0-553.19.1.rt7.360.el8_10 [RHEL-53529] - drm/i915/vma: Fix UAF on destroy against retire race (Mika Penttilä) [RHEL-35222] {CVE-2024-26939} - RHEL-48620 (Kenneth Yin) [RHEL-48620] - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (CKI Backport Bot) [RHEL-42721] {CVE-2024-26855} - net: usb: asix: do not force pause frames support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix "can't send until first packet is send" issue (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix modprobe "sysfs: cannot create duplicate filename" (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: add proper error handling of usb read errors (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix wrong return value in asix_check_host_enable() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix uninit-value in asix_mdio_read() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: fix boolconv.cocci warnings (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: do not call phy_disconnect() for ax88178 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: move embedded PHY detection as early as possible (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix uninit value bugs (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add missing stop (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: suspend PHY on driver probe (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: manage PHY PM from MAC (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: add error handling for asix_mdio_* functions (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add phylib support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: refactor asix_read_phy_addr() and handle errors on return (Ken Cox) [RHEL-28108] {CVE-2021-47101} - SUNRPC: always free ctxt when freeing deferred request (Jay Shin) [RHEL-40936] - SUNRPC: double free xprt_ctxt while still in use (Jay Shin) [RHEL-40936] - SUNRPC: Remove svc_rqst::rq_xprt_hlen (Jay Shin) [RHEL-40936] - SUNRPC: Remove dead code in svc_tcp_release_rqst() (Jay Shin) [RHEL-40936] - x86/bugs: Extend VMware Retbleed workaround to Nehalem & earlier CPUs (Waiman Long) [RHEL-48646] - wifi: iwlwifi: read txq->read_ptr under lock (Jose Ignacio Tornos Martinez) [RHEL-39797] {CVE-2024-36922} - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (John Meneghini) [RHEL-39908] {CVE-2024-36919} - nbd: always initialize struct msghdr completely (Ming Lei) [RHEL-29498] {CVE-2024-26638} - block: don't call rq_qos_ops->done_bio if the bio isn't tracked (Ming Lei) [RHEL-42151] {CVE-2021-47412} - nvmet: fix a possible leak when destroy a ctrl during qp establishment (Maurizio Lombardi) [RHEL-52013] {CVE-2024-42152} - ipv6: prevent NULL dereference in ip6_output() (Sabrina Dubroca) [RHEL-39912] {CVE-2024-36901} - ppp: reject claimed-as-LCP but actually malformed packets (Guillaume Nault) [RHEL-51052] {CVE-2024-41044} - leds: trigger: Unregister sysfs attributes before calling deactivate() (CKI Backport Bot) [RHEL-54834] {CVE-2024-43830} - crypto: bcm - Fix pointer arithmetic (cki-backport-bot) [RHEL-44108] {CVE-2024-38579} - scsi: qedf: Ensure the copied buf is NUL terminated (John Meneghini) [RHEL-44195] {CVE-2024-38559} - x86/bhi: Avoid warning in #DB handler due to BHI mitigation (Waiman Long) [RHEL-53657] {CVE-2024-42240} - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (CKI Backport Bot) [RHEL-47529] {CVE-2024-40901} - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (CKI Backport Bot) [RHEL-39843] {CVE-2024-36902} - net: usb: ax88179_178a: improve link status logs (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: improve reset check (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: fix link status when link is set to down/up (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: avoid writing the mac address before first reading (Jose Ignacio Tornos Martinez) [RHEL-45167] - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - media: cec: cec-api: add locking in cec_release() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid confusing "transmit timed out" message (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid recursive cec_claim_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: remove length check of Timer Status (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: count low-drive, error and arb-lost conditions (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add note about *_from_edid() function usage in drm (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_unconfigured() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_nb_transmit_canceled() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: don't set last_initiator if tx in progress (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: disable adapter in cec_devnode_unregister (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: not all messages were passed on when monitoring (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add support for Absolute Volume Control (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: log when claiming LA fails unexpectedly (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: drop activate_cnt, use state info instead (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: reconfigure if the PA changes during configuration (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: fix is_configuring state (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: stop trying LAs on CEC_TX_STATUS_TIMEOUT (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't unconfigure if already unconfigured (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add optional adap_configured callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add xfer_timeout_ms field (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: use call_op and check for !unregistered (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix interrupt en/disable handling (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: drop unused 'enabled' field from struct cec_pin (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix off-by-one SFT check (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: rename timer overrun variables (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: correctly pass on reply results (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: abort if the current transmit was canceled (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: call enable_adap on s_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: media/cec.h: document cec_adapter fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix a deadlock situation (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: safely unhook lists in cec_data (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: copy sequence field for the reply (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix trivial style warnings (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: add 'unregistered' checks (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't use flush_scheduled_work() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: Use fallthrough pseudo-keyword (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: remove unused waitq and phys_addrs fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: silence shift wrapping warning in __cec_s_log_addrs() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: move the core to a separate directory (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - net/iucv: Avoid explicit cpumask var allocation on stack (CKI Backport Bot) [RHEL-51631] {CVE-2024-42094} - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (Dick Kennedy) [RHEL-40400] - KVM: selftests: Make hyperv_clock require TSC based system clocksource (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Run clocksource dependent tests with hyperv_clocksource_tsc_page too (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Use generic sys_clocksource_is_tsc() in vmx_nested_tsc_scaling_test (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Generalize check_clocksource() from kvm_clock_test (Vitaly Kuznetsov) [RHEL-19027] - firmware: cs_dsp: Return error if block header overflows file (CKI Backport Bot) [RHEL-53646] {CVE-2024-42238} - firmware: cs_dsp: Validate payload length before processing block (CKI Backport Bot) [RHEL-53638] {CVE-2024-42237} - mm, slub: fix potential memoryleak in kmem_cache_open() (Waiman Long) [RHEL-38404] {CVE-2021-47466} - slub: don't panic for memcg kmem cache creation failure (Waiman Long) [RHEL-38404] {CVE-2021-47466} - wifi: ath11k: fix htt pktlog locking (Jose Ignacio Tornos Martinez) [RHEL-38317] {CVE-2023-52800} - wifi: ath11k: fix dfs radar event locking (Jose Ignacio Tornos Martinez) [RHEL-38165] {CVE-2023-52798} - lib/generic-radix-tree.c: Don't overflow in peek() (Waiman Long) [RHEL-37737] {CVE-2021-47432} - include/linux/generic-radix-tree.h: replace kernel.h with the necessary inclusions (Waiman Long) [RHEL-37737] {CVE-2021-47432} - EDAC/i10nm: Skip the absent memory controllers (Aristeu Rozanski) [RHEL-43236] - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (John Meneghini) [RHEL-38197] {CVE-2023-52809} - gfs2: Fix potential glock use-after-free on unmount (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: simplify gdlm_put_lock with out_free label (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: Remove ill-placed consistency check (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - nvme-fc: do not wait in vain when unloading module (Ewan D. Milne) [RHEL-33083] {CVE-2024-26846} - HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts (CKI Backport Bot) [RHEL-49698] {CVE-2022-48866} - scsi: qedf: Set qed_slowpath_params to zero before use (John Meneghini) [RHEL-9797] - scsi: qedf: Wait for stag work during unload (John Meneghini) [RHEL-9797] - scsi: qedf: Don't process stag work during unload and recovery (John Meneghini) [RHEL-9797] - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - mm: avoid overflows in dirty throttling logic (Audra Mitchell) [RHEL-51840] {CVE-2024-42131} - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - ACPI: fix NULL pointer dereference (Mark Langsdorf) [RHEL-37897] {CVE-2021-47289} - [rt] build kernel-rt-4.18.0-553.18.1.rt7.359.el8_10 [RHEL-53529] - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING (Ewan D. Milne) [RHEL-39805] {CVE-2024-36920} - tun: limit printing rate when illegal packet received by tun dev (Jon Maloy) [RHEL-35046] {CVE-2024-27013} - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu/mes: fix use-after-free issue (Michel Dänzer) [RHEL-44043] {CVE-2024-38581} - drm/amdgpu: Fix the null pointer when load rlc firmware (Michel Dänzer) [RHEL-30603] {CVE-2024-26649} - drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (Michel Dänzer) [RHEL-35160] {CVE-2024-27042} - net/sched: Fix UAF when resolving a clash (Xin Long) [RHEL-51014] {CVE-2024-41040} - tcp_metrics: validate source addr length (Guillaume Nault) [RHEL-52025] {CVE-2024-42154} - NFSv4/pnfs: Fix a use-after-free bug in open (Benjamin Coddington) [RHEL-35508] - NFSv4: Don't hold the layoutget locks across multiple RPC calls (Benjamin Coddington) [RHEL-35508] - scsi: qedf: Make qedf_execute_tmf() non-preemptible (John Meneghini) [RHEL-51799] {CVE-2024-42124} - Input: elantech - fix stack out of bound access in elantech_change_report_id() (CKI Backport Bot) [RHEL-41938] {CVE-2021-47097} - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (CKI Backport Bot) [RHEL-28982] {CVE-2023-52478} - drm/radeon: fix UBSAN warning in kv_dpm.c (CKI Backport Bot) [RHEL-48399] {CVE-2024-40988} - usb: core: Don't hold the device lock while sleeping in do_proc_control() (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - USB: core: Make do_proc_control() and do_proc_bulk() killable (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - scsi: qedi: Fix crash while reading debugfs attribute (CKI Backport Bot) [RHEL-48327] {CVE-2024-40978} - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CKI Backport Bot) [RHEL-48309] {CVE-2024-40977} - net: tcp: accept old ack during closing (Jamie Bainbridge) [RHEL-52433] - wifi: iwlwifi: mvm: don't read past the mfuart notifcation (CKI Backport Bot) [RHEL-48016] {CVE-2024-40941} - net/iucv: fix use after free in iucv_sock_close() (Mete Durlu) [RHEL-53988] - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (CKI Backport Bot) [RHEL-47908] {CVE-2024-40929} - Input: aiptek - properly check endpoint type (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - use descriptors of current altsetting (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - fix endpoint sanity check (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB (CKI Backport Bot) [RHEL-52373] {CVE-2024-42226} - wifi: mt76: replace skb_put with skb_put_zero (CKI Backport Bot) [RHEL-52366] {CVE-2024-42225} - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (CKI Backport Bot) [RHEL-47776] {CVE-2024-40912} - wifi: cfg80211: Lock wiphy in cfg80211_get_station (CKI Backport Bot) [RHEL-47758] {CVE-2024-40911} - VMCI: Use struct_size() in kmalloc() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() (Steve Best) [RHEL-37325] {CVE-2024-35944} - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values (Jose Ignacio Tornos Martinez) [RHEL-51761] {CVE-2024-42114} - usb: atm: cxacru: fix endpoint checking in cxacru_bind() (CKI Backport Bot) [RHEL-51442] {CVE-2024-41097} - nfs: handle error of rpc_proc_register() in init_nfs_fs() (Scott Mayhew) [RHEL-39904] {CVE-2024-36939} - drm/radeon: check bo_va->bo is non-NULL before using it (CKI Backport Bot) [RHEL-51184] {CVE-2024-41060} - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). (CKI Backport Bot) [RHEL-51027] {CVE-2024-41041} - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (CKI Backport Bot) [RHEL-50961] {CVE-2024-41035} - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). (CKI Backport Bot) [RHEL-44408] {CVE-2024-37356} - tcp: avoid too many retransmit packets (Florian Westphal) [RHEL-48627] {CVE-2024-41007} - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() (Florian Westphal) [RHEL-48627] - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Florian Westphal) [RHEL-48627] - tcp: refactor tcp_retransmit_timer() (Florian Westphal) [RHEL-48627] - tcp: exit if nothing to retransmit on RTO timeout (Florian Westphal) [RHEL-48627] - netfilter: nf_tables: Reject tables of unsupported family (Florian Westphal) [RHEL-21418] {CVE-2023-6040} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.23.1.rt7.364.el8_10 [RHEL-59541] - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002] - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924} - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042} - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070} - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898} - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301} - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976} - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540} - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284} - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857} - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924} - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983} - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854} - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936} - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093} - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961} - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880} - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244} - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984} - [rt] build kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 [RHEL-53529] - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071} - [rt] build kernel-rt-4.18.0-553.21.1.rt7.362.el8_10 [RHEL-53529] - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874] - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558} - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441} - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904} - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322} - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246} - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008} - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228} - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.23.1.rt7.364.el8_10 [RHEL-59541] - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002] - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924} - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042} - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070} - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898} - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301} - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976} - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540} - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284} - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857} - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924} - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983} - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854} - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936} - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093} - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961} - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880} - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244} - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - [rt] build kernel-rt-4.18.0-553.35.1.rt7.376.el8_10 [RHEL-72569] - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480] - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480] - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396] - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - [rt] build kernel-rt-4.18.0-553.35.1.rt7.376.el8_10 [RHEL-72569] - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480] - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480] - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396] - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - [rt] build kernel-rt-4.18.0-553.35.1.rt7.376.el8_10 [RHEL-72569] - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480] - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480] - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396] - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.5.1.rt7.346.el8_10 [RHEL-34640] - tools/power/turbostat: Fix uncore frequency file string (David Arcari) [RHEL-29238] - tools/power turbostat: Expand probe_intel_uncore_frequency() (David Arcari) [RHEL-29238] - uio: Fix use-after-free in uio_open (Ricardo Robaina) [RHEL-26232] {CVE-2023-52439} - net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (Ken Cox) [RHEL-27316] {CVE-2021-47013} - keys: Fix linking a duplicate key to a keyring's assoc_array (David Howells) [RHEL-30772] - keys: Hoist locking out of __key_link_begin() (David Howells) [RHEL-30772] - keys: Break bits out of key_unlink() (David Howells) [RHEL-30772] - keys: Change keyring_serialise_link_sem to a mutex (David Howells) [RHEL-30772] - wifi: brcm80211: handle pmk_op allocation failure (Jose Ignacio Tornos Martinez) [RHEL-35150] {CVE-2024-27048} - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work (Jose Ignacio Tornos Martinez) [RHEL-35140] {CVE-2024-27052} - wifi: iwlwifi: mvm: ensure offloading TID queue exists (Jose Ignacio Tornos Martinez) [RHEL-35130] {CVE-2024-27056} - wifi: mt76: mt7921e: fix use-after-free in free_irq() (Jose Ignacio Tornos Martinez) [RHEL-34866] {CVE-2024-26892} - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete (Jose Ignacio Tornos Martinez) [RHEL-34189] {CVE-2024-26897} - wifi: iwlwifi: mvm: fix a crash when we run out of stations (Jose Ignacio Tornos Martinez) [RHEL-31547] {CVE-2024-26693} - wifi: iwlwifi: fix double-free bug (Jose Ignacio Tornos Martinez) [RHEL-31543] {CVE-2024-26694} - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (Jose Ignacio Tornos Martinez) [RHEL-29089] {CVE-2023-52594} - wifi: rt2x00: restart beacon queue when hardware reset (Jose Ignacio Tornos Martinez) [RHEL-29093] {CVE-2023-52595} - wifi: iwlwifi: fix a memory corruption (Jose Ignacio Tornos Martinez) [RHEL-28903] {CVE-2024-26610} - [rt] build kernel-rt-4.18.0-553.4.1.rt7.345.el8_10 [RHEL-34640] - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117] - net/mlx5e: Prevent deadlock while disabling aRFS (Kamal Heib) [RHEL-35041] {CVE-2024-27014} - x86/tsc: Defer marking TSC unstable to a worker (Wander Lairson Costa) [RHEL-32676] - x86/smpboot: Make TSC synchronization function call based (Wander Lairson Costa) [RHEL-32676] - net: usb: fix possible use-after-free in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - net: usb: fix memory leak in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - [rt] build kernel-rt-4.18.0-552.3.1.rt7.344.el8_10 [RHEL-34640] - netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (Phil Sutter) [RHEL-30076] {CVE-2024-26643} - netfilter: nf_tables: disallow anonymous set with timeout flag (Phil Sutter) [RHEL-30080] {CVE-2024-26642} - selftests/bpf: Fix pyperf180 compilation failure with clang18 (Artem Savkov) [RHEL-35576] - md/raid5: fix atomicity violation in raid5_cache_count (Nigel Croxon) [RHEL-27930] {CVE-2024-23307} - usb: ulpi: Fix debugfs directory leak (Desnes Nunes) [RHEL-33287] {CVE-2024-26919} - powerpc/pseries: Fix potential memleak in papr_get_attr() (Mamatha Inamdar) [RHEL-35213] {CVE-2022-48669} - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (Desnes Nunes) [RHEL-35122] {CVE-2024-27059} - NFSv4: fairly test all delegations on a SEQ4_ revocation (Benjamin Coddington) [RHEL-34912] - USB: core: Fix deadlock in usb_deauthorize_interface() (Desnes Nunes) [RHEL-35002] {CVE-2024-26934} - usb: xhci: Add error handling in xhci_map_urb_for_dma (Desnes Nunes) [RHEL-34958] {CVE-2024-26964} - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (Ewan D. Milne) [RHEL-35076] {CVE-2024-26993} - xhci: handle isoc Babble and Buffer Overrun events properly (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - xhci: process isoc TD properly when there was a transaction error mid TD. (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - USB: core: Fix deadlock in port "disable" sysfs attribute (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - USB: core: Add hub_get() and hub_put() routines (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - netfilter: ipset: Missing gc cancellations fixed (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix performance regression in swap operation (Phil Sutter) [RHEL-30521] - netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test (Phil Sutter) [RHEL-30521] - x86/apic/x2apic: Fix a NULL pointer deref when handling a dying cpu (David Arcari) [RHEL-32516] - x86/coco: Disable 32-bit emulation by default on TDX and SEV (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Make IA32_EMULATION boot time configurable (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/elf: Make loading of 32bit processes depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Rename ignore_sysret() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/cpu: Don't write CSTAR MSR on Intel CPUs (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Introduce ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - [rt] build kernel-rt-4.18.0-552.2.1.rt7.343.el8_10 [RHEL-34640] - s390/ptrace: handle setting of fpc register correctly (Tobias Huschle) [RHEL-29106] {CVE-2023-52598} - net/smc: fix illegal rmb_desc access in SMC-D connection dump (Tobias Huschle) [RHEL-27746] {CVE-2024-26615} - wifi: mac80211: fix race condition on enabling fast-xmit (Jose Ignacio Tornos Martinez) [RHEL-31664] {CVE-2024-26779} - powerpc/fadump: make is_kdump_kernel() return false when fadump is active (Mamatha Inamdar) [RHEL-24401] - vmcore: remove dependency with is_kdump_kernel() for exporting vmcore (Mamatha Inamdar) [RHEL-24401] - mtd: require write permissions for locking and badblock ioctls (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - mtd: properly check all write ioctls for permissions (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - pid: take a reference when initializing `cad_pid` (Waiman Long) [RHEL-29420] {CVE-2021-47118} - i2c: i801: Don't generate an interrupt on bus reset (Prarit Bhargava) [RHEL-30325] {CVE-2021-47153} - RDMA/srpt: Do not register event handler until srpt device is fully setup (Kamal Heib) [RHEL-33224] {CVE-2024-26872} - ceph: switch to corrected encoding of max_xattr_size in mdsmap (Xiubo Li) [RHEL-26723] - ceph: switch to use cap_delay_lock for the unlink delay list (Xiubo Li) [RHEL-32870] - ceph: pass ino# instead of old_dentry if it's disconnected (Xiubo Li) [RHEL-32870] - fat: fix uninitialized field in nostale filehandles (Andrey Albershteyn) [RHEL-33186 RHEL-35108] {CVE-2024-26973} - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (Andrey Albershteyn) [RHEL-33186] {CVE-2024-26901} - idpf: limit the support to GCP only (Michal Schmidt) [RHEL-15652] - redhat/configs: enable CONFIG_IDPF (Michal Schmidt) [RHEL-15652] - idpf: remove the use of ETHTOOL_RING_USE_TCP_DATA_SPLIT (Michal Schmidt) [RHEL-15652] - idpf: workaround for unavailable skb page recycling (Michal Schmidt) [RHEL-15652] - idpf: always allocate a full page (Michal Schmidt) [RHEL-15652] - idpf: remove page pool stats code (Michal Schmidt) [RHEL-15652] - idpf: add minimal macros for __free(kfree) to work (Michal Schmidt) [RHEL-15652] - idpf: fixup include paths for RHEL 8 (Michal Schmidt) [RHEL-15652] - idpf: fix kernel panic on unknown packet types (Michal Schmidt) [RHEL-15652] - idpf: disable local BH when scheduling napi for marker packets (Michal Schmidt) [RHEL-15652] - idpf: remove dealloc vector msg err in idpf_intr_rel (Michal Schmidt) [RHEL-15652] - idpf: fix minor controlq issues (Michal Schmidt) [RHEL-15652] - idpf: prevent deinit uninitialized virtchnl core (Michal Schmidt) [RHEL-15652] - idpf: cleanup virtchnl cruft (Michal Schmidt) [RHEL-15652] - idpf: refactor idpf_recv_mb_msg (Michal Schmidt) [RHEL-15652] - idpf: add async_handler for MAC filter messages (Michal Schmidt) [RHEL-15652] - idpf: refactor remaining virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor queue related virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor vport virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: implement virtchnl transaction manager (Michal Schmidt) [RHEL-15652] - idpf: add idpf_virtchnl.h (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler padding in virtchnl2_ptype struct (Michal Schmidt) [RHEL-15652] - idpf: distinguish vports by the dev_port attribute (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler introduced padding in virtchnl2_rss_key struct (Michal Schmidt) [RHEL-15652] - idpf: fix corrupted frames and skb leaks in singleq mode (Michal Schmidt) [RHEL-15652] - idpf: refactor some missing field get/prep conversions (Michal Schmidt) [RHEL-15652] - idpf: add get/set for Ethtool's header split ringparam (Michal Schmidt) [RHEL-15652] - idpf: fix potential use-after-free in idpf_tso() (Michal Schmidt) [RHEL-15652] - idpf: cancel mailbox work in error path (Michal Schmidt) [RHEL-15652] - idpf: set scheduling mode for completion queue (Michal Schmidt) [RHEL-15652] - idpf: add SRIOV support and other ndo_ops (Michal Schmidt) [RHEL-15652] - idpf: add ethtool callbacks (Michal Schmidt) [RHEL-15652] - idpf: add singleq start_xmit and napi poll (Michal Schmidt) [RHEL-15652] - idpf: add RX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add TX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add splitq start_xmit (Michal Schmidt) [RHEL-15652] - idpf: initialize interrupts and enable vport (Michal Schmidt) [RHEL-15652] - idpf: configure resources for RX queues (Michal Schmidt) [RHEL-15652] - idpf: configure resources for TX queues (Michal Schmidt) [RHEL-15652] - idpf: add ptypes and MAC filter support (Michal Schmidt) [RHEL-15652] - idpf: add create vport and netdev configuration (Michal Schmidt) [RHEL-15652] - idpf: add core init and interrupt request (Michal Schmidt) [RHEL-15652] - idpf: add controlq init and reset checks (Michal Schmidt) [RHEL-15652] - idpf: add module register and probe functionality (Michal Schmidt) [RHEL-15652] - virtchnl: add virtchnl version 2 ops (Michal Schmidt) [RHEL-15652] - net: netdev_queue: netdev_txq_completed_mb(): fix wake condition (Michal Schmidt) [RHEL-15652] - net: piggy back on the memory barrier in bql when waking queues (Michal Schmidt) [RHEL-15652] - net: provide macros for commonly copied lockless queue stop/wake code (Michal Schmidt) [RHEL-15652] - [rt] build kernel-rt-4.18.0-552.1.1.rt7.342.el8_10 [RHEL-34640] - build: Update RTBZ for 8.10 z-stream builds (Denys Vlasenko) - redhat: set DIST to el8_10 and ZSTREAM to yes for 8.10 (Denys Vlasenko) - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (Prarit Bhargava) [RHEL-32590] {CVE-2021-47185} - net: mana: Fix Rx DMA datasize and skb_over_panic (Cathy Avery) [RHEL-32579] - RDMA/srpt: Support specifying the srpt_service_guid parameter (Kamal Heib) [RHEL-31710] {CVE-2024-26744} - RDMA/qedr: Fix qedr_create_user_qp error flow (Kamal Heib) [RHEL-31714] {CVE-2024-26743} - hwmon: (coretemp) Fix out-of-bounds memory access (David Arcari) [RHEL-31305] {CVE-2024-26664} - RDMA/irdma: Fix KASAN issue with tasklet (Kamal Heib) [RHEL-15776] - net: bridge: use DEV_STATS_INC() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: Fix unwanted sign extension in netdev_stats_to_stats64() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: add atomic_long_t to net_device_stats fields (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net/sched: act_ct: fix skb leak and crash on ooo frags (Xin Long) [RHEL-29467] {CVE-2023-52610} - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Jose Ignacio Tornos Martinez) [RHEL-28015] {CVE-2023-52528} - RDMA/core: Fix uninit-value access in ib_get_eth_speed() (Kamal Heib) [RHEL-30130] - RDMA/core: Get IB width and speed from netdev (Kamal Heib) [RHEL-30130] - cpufreq: intel_pstate: Add Emerald Rapids support in no-HWP mode (Prarit Bhargava) [RHEL-29444] - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add (Mamatha Inamdar) [RHEL-29118] {CVE-2023-52607} - powerpc/lib: Validate size for vector operations (Mamatha Inamdar) [RHEL-29114] {CVE-2023-52606} - usb: hub: Guard against accesses to uninitialized BOS descriptors (Desnes Nunes) [RHEL-28986] {CVE-2023-52477} - media: uvcvideo: Fix OOB read (Desnes Nunes) [RHEL-27940] {CVE-2023-52565} - media: pvrusb2: fix use after free on context disconnection (Desnes Nunes) [RHEL-26498] {CVE-2023-52445} - i2c: i801: Fix block process call transactions (Prarit Bhargava) [RHEL-26478] {CVE-2024-26593} - overlay: disable EVM (Coiby Xu) [RHEL-19863] - evm: add support to disable EVM on unsupported filesystems (Coiby Xu) [RHEL-19863] - evm: don't copy up 'security.evm' xattr (Coiby Xu) [RHEL-19863] - net: ena: Remove ena_select_queue (Kamal Heib) [RHEL-14286] - media: dvbdev: Fix memory leak in dvb_media_device_free() (Prarit Bhargava) [RHEL-27254] {CVE-2020-36777} - gfs2: Fix invalid metadata access in punch_hole (Andrew Price) [RHEL-28784] - i2c: Fix a potential use after free (Prarit Bhargava) [RHEL-26849] {CVE-2019-25162} - i2c: validate user data in compat ioctl (Prarit Bhargava) [RHEL-27022] {CVE-2021-46934} - platform/x86: think-lmi: Fix reference leak (Prarit Bhargava) [RHEL-28030] {CVE-2023-52520} - vhost: use kzalloc() instead of kmalloc() followed by memset() (Jon Maloy) [RHEL-21505] {CVE-2024-0340} - RDMA/siw: Fix connection failure handling (Kamal Heib) [RHEL-28042] {CVE-2023-52513} - vt: fix memory overlapping when deleting chars in the buffer (Waiman Long) [RHEL-27778 RHEL-27779] {CVE-2022-48627} - x86/fpu: Stop relying on userspace for info to fault in xsave buffer (Steve Best) [RHEL-26669] {CVE-2024-26603} - mptcp: fix double-free on socket dismantle (Davide Caratti) [RHEL-22773] {CVE-2024-26782} - crypto: akcipher - Disable signing and decryption (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: akcipher - default implementations for request callbacks (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: testmgr - split akcipher tests by a key type (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - workqueue: Warn when a rescuer could not be created (Waiman Long) [RHEL-22136] - RDMA/cma: Avoid GID lookups on iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/cma: Deduplicate error flow in cma_validate_port() (Benjamin Coddington) [RHEL-12456] - RDMA/core: Set gid_attr.ndev for iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/siw: Fabricate a GID on tun and loopback devices (Benjamin Coddington) [RHEL-12456] - eventpoll: fix missing wakeup for ovflist in ep_poll_callback (Luis Claudio R. Goncalves) [RHEL-23022] - [rt] build kernel-rt-4.18.0-552.rt7.341.el8 [RHEL-5332] - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248] - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248] - [rt] build kernel-rt-4.18.0-551.rt7.340.el8 [RHEL-5332] - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742} - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992] - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992] - [rt] build kernel-rt-4.18.0-550.rt7.339.el8 [RHEL-5332] - mm/sparsemem: fix race in accessing memory_section->usage (Waiman Long) [RHEL-28875 RHEL-28876] {CVE-2023-52489} - mm: use __pfn_to_section() instead of open coding it (Waiman Long) [RHEL-28875] {CVE-2023-52489} - [rt] build kernel-rt-4.18.0-549.rt7.338.el8 [RHEL-5332] - dm-integrity: align the outgoing bio in integrity_recheck (Benjamin Marzinski) [RHEL-29678] - dm-integrity: fix a memory leak when rechecking the data (Benjamin Marzinski) [RHEL-29678] - RDMA/mana_ib: Add CQ interrupt support for RAW QP (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: query device capabilities (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: register RDMA device with GDMA (Maxim Levitsky) [RHEL-23934] - net: mana: add msix index sharing between EQs (Maxim Levitsky) [RHEL-23934] - net: mana: Fix spelling mistake "enforecement" -> "enforcement" (Maxim Levitsky) [RHEL-23934] - net :mana :Add remaining GDMA stats for MANA to ethtool (Maxim Levitsky) [RHEL-23934] - net: mana: Fix oversized sge0 for GSO packets (Maxim Levitsky) [RHEL-23934] - net: mana: Fix TX CQE error handling (Maxim Levitsky) [RHEL-23934] - net: mana: Add gdma stats to ethtool output for mana (Maxim Levitsky) [RHEL-23934] - net: mana: Fix MANA VF unload when hardware is unresponsive (Maxim Levitsky) [RHEL-23934] - net: mana: Configure hwc timeout from hardware (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (Maxim Levitsky) [RHEL-23934] - [rt] build kernel-rt-4.18.0-548.rt7.337.el8 [RHEL-5332] - gitlab-ci: enable arm64/s390x/ppc64le debug builds (Michael Hofmann) - arm64: Add missing bits of AmpereOne Spectre-BHB mitigation (Mark Salter) [RHEL-29005] - [rt] enable CONFIG_DRM_MGAG200_IOBURST_WORKAROUND (Jocelyn Falempe) [RHEL-13214] - drm/mgag200: Add a workaround for low-latency (Jocelyn Falempe) [RHEL-13214] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - [rt] build kernel-rt-4.18.0-553.8.1.rt7.349.el8_10 [RHEL-40882] - udf: Fix NULL pointer dereference in udf_symlink function (Pavel Reichl) [RHEL-37769] {CVE-2021-47353} - net: ti: fix UAF in tlan_remove_one (Jose Ignacio Tornos Martinez) [RHEL-38940] {CVE-2021-47310} - ARM: footbridge: fix PCI interrupt mapping (Myron Stowe) [RHEL-26971] {CVE-2021-46909} - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (Kamal Heib) [RHEL-37454] {CVE-2024-36004} - net/mlx5e: Fix mlx5e_priv_init() cleanup flow (Kamal Heib) [RHEL-37424] {CVE-2024-35959} - net/mlx5: Properly link new fs rules into the tree (Kamal Heib) [RHEL-37420] {CVE-2024-35960} - net/mlx5e: fix a potential double-free in fs_any_create_groups (Kamal Heib) [RHEL-37091] {CVE-2023-52667} - net: ena: Fix incorrect descriptor free behavior (Kamal Heib) [RHEL-37428] {CVE-2024-35958} - mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - mISDN: fix possible use-after-free in HFC_cleanup() (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - implement dh fallback for primes > 4K (Vladis Dronov) [RHEL-35106] - crypto: qat - avoid division by zero (Vladis Dronov) [RHEL-35106] - crypto: qat - resolve race condition during AER recovery (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - use kcalloc_node() instead of kzalloc_node() (Vladis Dronov) [RHEL-35106] - [rt] Enable CONFIG_DRM_MGAG200_DISABLE_WRITECOMBINE (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Add an option to disable Write-Combine (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Fix caching setup for remapped video memory (Jocelyn Falempe) [RHEL-36172] - Revert "drm/mgag200: Add a workaround for low-latency" (Jocelyn Falempe) [RHEL-36172] - mptcp: fix data re-injection from stale subflow (Davide Caratti) [RHEL-33133] {CVE-2024-26826} - ipv6: sr: fix incorrect unregister order (Hangbin Liu) [RHEL-31730] - ipv6: sr: fix possible use-after-free and null-ptr-deref (Hangbin Liu) [RHEL-31730] {CVE-2024-26735} - net/bnx2x: Prevent access to a freed page in page_pool (Michal Schmidt) [RHEL-14195 RHEL-33243] {CVE-2024-26859} - bnx2x: new flag for track HW resource allocation (Michal Schmidt) [RHEL-14195 RHEL-33243] - bnx2x: fix page fault following EEH recovery (Michal Schmidt) [RHEL-14195 RHEL-33243] - x86: KVM: SVM: always update the x2avic msr interception (Maxim Levitsky) [RHEL-15495] {CVE-2023-5090} - EDAC/thunderx: Fix possible out-of-bounds string access (Aristeu Rozanski) [RHEL-26573] {CVE-2023-52464} - [rt] build kernel-rt-4.18.0-553.7.1.rt7.348.el8_10 [RHEL-34640] - net: qcom/emac: fix UAF in emac_remove (Ken Cox) [RHEL-37834] {CVE-2021-47311} - perf/core: Bail out early if the request AUX area is out of bound (Michael Petlan) [RHEL-38268] {CVE-2023-52835} - crypto: pcrypt - Fix hungtask for PADATA_RESET (Herbert Xu) [RHEL-38171] {CVE-2023-52813} - drm/amdgpu: fix use-after-free bug (Jocelyn Falempe) [RHEL-31240] {CVE-2024-26656} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash (Ivan Vecera) [RHEL-37008] {CVE-2024-35854} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update (Ivan Vecera) [RHEL-37004] {CVE-2024-35855} - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (Ivan Vecera) [RHEL-37012] {CVE-2024-35853} - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work (Ivan Vecera) [RHEL-37016] {CVE-2024-35852} - mlxsw: spectrum_acl_tcam: Fix warning during rehash (Ivan Vecera) [RHEL-37480] {CVE-2024-36007} - can: peak_pci: peak_pci_remove(): fix UAF (Jose Ignacio Tornos Martinez) [RHEL-38419] {CVE-2021-47456} - usbnet: fix error return code in usbnet_probe() (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - usbnet: sanity check for maxpacket (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - net/mlx5e: fix a double-free in arfs_create_groups (Kamal Heib) [RHEL-36920] {CVE-2024-35835} - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds (Jose Ignacio Tornos Martinez) [RHEL-38220] {CVE-2023-52878} - net: cdc_eem: fix tx fixup skb leak (Jose Ignacio Tornos Martinez) [RHEL-38080] {CVE-2021-47236} - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Jose Ignacio Tornos Martinez) [RHEL-38113] {CVE-2023-52703} - usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() (Desnes Nunes) [RHEL-38248] {CVE-2023-52877} - usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (Desnes Nunes) [RHEL-38240] {CVE-2023-52781} - gro: fix ownership transfer (Xin Long) [RHEL-37226] {CVE-2024-35890} - tipc: fix kernel warning when sending SYN message (Xin Long) [RHEL-38109] {CVE-2023-52700} - erspan: make sure erspan_base_hdr is present in skb->head (Xin Long) [RHEL-37230] {CVE-2024-35888} - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() (Bryan Gurney) [RHEL-17366] - scsi: mpi3mr: Sanitise num_phys (Bryan Gurney) [RHEL-17366] - netfilter: nf_tables: use timestamp to check for set element timeout (Phil Sutter) [RHEL-38023] {CVE-2024-27397} - net/ipv6: SKB symmetric hash should incorporate transport ports (Sabrina Dubroca) [RHEL-32061] - crypto: s390/aes - Fix buffer overread in CTR mode (Herbert Xu) [RHEL-37089] {CVE-2023-52669} - net: Save and restore msg_namelen in sock_sendmsg (Jamie Bainbridge) [RHEL-35893] - net: prevent address rewrite in kernel_bind() (Jamie Bainbridge) [RHEL-35893] - net: prevent rewrite of msg_name in sock_sendmsg() (Jamie Bainbridge) [RHEL-35893] - net: replace calls to sock->ops->connect() with kernel_connect() (Jamie Bainbridge) [RHEL-35893] - net: Avoid address overwrite in kernel_connect (Jamie Bainbridge) [RHEL-35893] - wifi: iwlwifi: dbg-tlv: ensure NUL termination (Jose Ignacio Tornos Martinez) [RHEL-37026] {CVE-2024-35845} - wifi: mac80211: fix potential sta-link leak (Jose Ignacio Tornos Martinez) [RHEL-36916] {CVE-2024-35838} - wifi: nl80211: reject iftype change with mesh ID change (Jose Ignacio Tornos Martinez) [RHEL-36884] {CVE-2024-27410} - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (Jose Ignacio Tornos Martinez) [RHEL-36807] {CVE-2024-35789} - Bluetooth: Avoid potential use-after-free in hci_error_reset (David Marlin) [RHEL-31826] {CVE-2024-26801} - tls: disable async encrypt/decrypt (Sabrina Dubroca) [RHEL-26362 RHEL-26409 RHEL-26420] {CVE-2024-26585 CVE-2024-26583 CVE-2024-26584} - Squashfs: check the inode number is not the invalid value of zero (Phillip Lougher) [RHEL-35096] {CVE-2024-26982} - ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/msg.c: update and document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/sem.c: document and update memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: update/document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: remove duplicated code (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (Kamal Heib) [RHEL-30582] {CVE-2023-52626} - Revert "ACPI: bus: Rework system-level device notification handling" (Prarit Bhargava) [RHEL-21486] - hwrng: core - Fix page fault dead lock on mmap-ed hwrng (Prarit Bhargava) [RHEL-29485] {CVE-2023-52615} - [rt] build kernel-rt-4.18.0-553.6.1.rt7.347.el8_10 [RHEL-34640] - cxgb4: Properly lock TX queue for the selftest. (John B. Wyatt IV) [RHEL-8779] - powerpc/powernv: Add a null pointer check in opal_event_init() (Mamatha Inamdar) [RHEL-37058] {CVE-2023-52686} - crypto: rsa - add a check for allocation failure (Vladis Dronov) [RHEL-35361] - crypto: rsa - allow only odd e and restrict value in FIPS mode (Vladis Dronov) [RHEL-35361] - KEYS: use kfree_sensitive with key (Vladis Dronov) [RHEL-35361] - lib/mpi: Extend the MPI library (only mpi_*_bit() part) (Vladis Dronov) [RHEL-35361] - net: ip_tunnel: prevent perpetual headroom growth (Felix Maurer) [RHEL-31814] {CVE-2024-26804} - s390/cpum_cf: make crypto counters upward compatible across machine types (Tobias Huschle) [RHEL-36048] - RDMA/mlx5: Fix fortify source warning while accessing Eth segment (Kamal Heib) [RHEL-33162] {CVE-2024-26907} - ovl: fix leaked dentry (Miklos Szeredi) [RHEL-27306] {CVE-2021-46972} - x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - x86/mm/vsyscall: Consider vsyscall page part of user address space (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - x86/mm: Add vsyscall address helper (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - mm/swap: fix race when skipping swapcache (Rafael Aquini) [RHEL-31644] {CVE-2024-26759} - swap: fix do_swap_page() race with swapoff (Rafael Aquini) [RHEL-31644] {CVE-2024-26759} - mm/swapfile: use percpu_ref to serialize against concurrent swapoff (Rafael Aquini) [RHEL-31644] {CVE-2024-26759} - mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions() (Rafael Aquini) [RHEL-29294] {CVE-2023-52560} - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr (Jiri Benc) [RHEL-29783] - block: null_blk: Fix handling of fake timeout request (Ming Lei) [RHEL-8130] - null_blk: fix poll request timeout handling (Ming Lei) [RHEL-8130] - block: null_blk: end timed out poll request (Ming Lei) [RHEL-8130] - block: null_blk: only set set->nr_maps as 3 if active poll_queues is > 0 (Ming Lei) [RHEL-8130] - null_blk: allow zero poll queues (Ming Lei) [RHEL-8130] - null_blk: Fix handling of submit_queues and poll_queues attributes (Ming Lei) [RHEL-8130] - null_blk: poll queue support (Ming Lei) [RHEL-8130] - null_blk: fix command timeout completion handling (Ming Lei) [RHEL-8130] - platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (Prarit Bhargava) [RHEL-27790] {CVE-2021-47073} - Bluetooth: avoid memcmp() out of bounds warning (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: hci_event: Fix coding style (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: hci_event: Fix using memcmp when comparing keys (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: Reject connection with the device which has same BD_ADDR (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: hci_event: Ignore NULL link key (David Marlin) [RHEL-3017] {CVE-2020-26555} - ppp_async: limit MRU to 64K (Guillaume Nault) [RHEL-31353] {CVE-2024-26675} - powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (Mamatha Inamdar) [RHEL-37078] {CVE-2023-52675} - tcp: do not accept ACK of bytes we never sent (Xin Long) [RHEL-21952] - [rt] build kernel-rt-4.18.0-553.5.1.rt7.346.el8_10 [RHEL-34640] - tools/power/turbostat: Fix uncore frequency file string (David Arcari) [RHEL-29238] - tools/power turbostat: Expand probe_intel_uncore_frequency() (David Arcari) [RHEL-29238] - uio: Fix use-after-free in uio_open (Ricardo Robaina) [RHEL-26232] {CVE-2023-52439} - net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (Ken Cox) [RHEL-27316] {CVE-2021-47013} - keys: Fix linking a duplicate key to a keyring's assoc_array (David Howells) [RHEL-30772] - keys: Hoist locking out of __key_link_begin() (David Howells) [RHEL-30772] - keys: Break bits out of key_unlink() (David Howells) [RHEL-30772] - keys: Change keyring_serialise_link_sem to a mutex (David Howells) [RHEL-30772] - wifi: brcm80211: handle pmk_op allocation failure (Jose Ignacio Tornos Martinez) [RHEL-35150] {CVE-2024-27048} - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work (Jose Ignacio Tornos Martinez) [RHEL-35140] {CVE-2024-27052} - wifi: iwlwifi: mvm: ensure offloading TID queue exists (Jose Ignacio Tornos Martinez) [RHEL-35130] {CVE-2024-27056} - wifi: mt76: mt7921e: fix use-after-free in free_irq() (Jose Ignacio Tornos Martinez) [RHEL-34866] {CVE-2024-26892} - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete (Jose Ignacio Tornos Martinez) [RHEL-34189] {CVE-2024-26897} - wifi: iwlwifi: mvm: fix a crash when we run out of stations (Jose Ignacio Tornos Martinez) [RHEL-31547] {CVE-2024-26693} - wifi: iwlwifi: fix double-free bug (Jose Ignacio Tornos Martinez) [RHEL-31543] {CVE-2024-26694} - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (Jose Ignacio Tornos Martinez) [RHEL-29089] {CVE-2023-52594} - wifi: rt2x00: restart beacon queue when hardware reset (Jose Ignacio Tornos Martinez) [RHEL-29093] {CVE-2023-52595} - wifi: iwlwifi: fix a memory corruption (Jose Ignacio Tornos Martinez) [RHEL-28903] {CVE-2024-26610} - [rt] build kernel-rt-4.18.0-553.4.1.rt7.345.el8_10 [RHEL-34640] - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117] - net/mlx5e: Prevent deadlock while disabling aRFS (Kamal Heib) [RHEL-35041] {CVE-2024-27014} - x86/tsc: Defer marking TSC unstable to a worker (Wander Lairson Costa) [RHEL-32676] - x86/smpboot: Make TSC synchronization function call based (Wander Lairson Costa) [RHEL-32676] - net: usb: fix possible use-after-free in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - net: usb: fix memory leak in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - [rt] build kernel-rt-4.18.0-552.3.1.rt7.344.el8_10 [RHEL-34640] - netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (Phil Sutter) [RHEL-30076] {CVE-2024-26643} - netfilter: nf_tables: disallow anonymous set with timeout flag (Phil Sutter) [RHEL-30080] {CVE-2024-26642} - selftests/bpf: Fix pyperf180 compilation failure with clang18 (Artem Savkov) [RHEL-35576] - md/raid5: fix atomicity violation in raid5_cache_count (Nigel Croxon) [RHEL-27930] {CVE-2024-23307} - usb: ulpi: Fix debugfs directory leak (Desnes Nunes) [RHEL-33287] {CVE-2024-26919} - powerpc/pseries: Fix potential memleak in papr_get_attr() (Mamatha Inamdar) [RHEL-35213] {CVE-2022-48669} - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (Desnes Nunes) [RHEL-35122] {CVE-2024-27059} - NFSv4: fairly test all delegations on a SEQ4_ revocation (Benjamin Coddington) [RHEL-34912] - USB: core: Fix deadlock in usb_deauthorize_interface() (Desnes Nunes) [RHEL-35002] {CVE-2024-26934} - usb: xhci: Add error handling in xhci_map_urb_for_dma (Desnes Nunes) [RHEL-34958] {CVE-2024-26964} - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (Ewan D. Milne) [RHEL-35076] {CVE-2024-26993} - xhci: handle isoc Babble and Buffer Overrun events properly (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - xhci: process isoc TD properly when there was a transaction error mid TD. (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - USB: core: Fix deadlock in port "disable" sysfs attribute (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - USB: core: Add hub_get() and hub_put() routines (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - netfilter: ipset: Missing gc cancellations fixed (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix performance regression in swap operation (Phil Sutter) [RHEL-30521] - netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test (Phil Sutter) [RHEL-30521] - x86/apic/x2apic: Fix a NULL pointer deref when handling a dying cpu (David Arcari) [RHEL-32516] - x86/coco: Disable 32-bit emulation by default on TDX and SEV (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Make IA32_EMULATION boot time configurable (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/elf: Make loading of 32bit processes depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Rename ignore_sysret() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/cpu: Don't write CSTAR MSR on Intel CPUs (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Introduce ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - [rt] build kernel-rt-4.18.0-552.2.1.rt7.343.el8_10 [RHEL-34640] - s390/ptrace: handle setting of fpc register correctly (Tobias Huschle) [RHEL-29106] {CVE-2023-52598} - net/smc: fix illegal rmb_desc access in SMC-D connection dump (Tobias Huschle) [RHEL-27746] {CVE-2024-26615} - wifi: mac80211: fix race condition on enabling fast-xmit (Jose Ignacio Tornos Martinez) [RHEL-31664] {CVE-2024-26779} - powerpc/fadump: make is_kdump_kernel() return false when fadump is active (Mamatha Inamdar) [RHEL-24401] - vmcore: remove dependency with is_kdump_kernel() for exporting vmcore (Mamatha Inamdar) [RHEL-24401] - mtd: require write permissions for locking and badblock ioctls (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - mtd: properly check all write ioctls for permissions (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - pid: take a reference when initializing `cad_pid` (Waiman Long) [RHEL-29420] {CVE-2021-47118} - i2c: i801: Don't generate an interrupt on bus reset (Prarit Bhargava) [RHEL-30325] {CVE-2021-47153} - RDMA/srpt: Do not register event handler until srpt device is fully setup (Kamal Heib) [RHEL-33224] {CVE-2024-26872} - ceph: switch to corrected encoding of max_xattr_size in mdsmap (Xiubo Li) [RHEL-26723] - ceph: switch to use cap_delay_lock for the unlink delay list (Xiubo Li) [RHEL-32870] - ceph: pass ino# instead of old_dentry if it's disconnected (Xiubo Li) [RHEL-32870] - fat: fix uninitialized field in nostale filehandles (Andrey Albershteyn) [RHEL-33186 RHEL-35108] {CVE-2024-26973} - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (Andrey Albershteyn) [RHEL-33186] {CVE-2024-26901} - idpf: limit the support to GCP only (Michal Schmidt) [RHEL-15652] - redhat/configs: enable CONFIG_IDPF (Michal Schmidt) [RHEL-15652] - idpf: remove the use of ETHTOOL_RING_USE_TCP_DATA_SPLIT (Michal Schmidt) [RHEL-15652] - idpf: workaround for unavailable skb page recycling (Michal Schmidt) [RHEL-15652] - idpf: always allocate a full page (Michal Schmidt) [RHEL-15652] - idpf: remove page pool stats code (Michal Schmidt) [RHEL-15652] - idpf: add minimal macros for __free(kfree) to work (Michal Schmidt) [RHEL-15652] - idpf: fixup include paths for RHEL 8 (Michal Schmidt) [RHEL-15652] - idpf: fix kernel panic on unknown packet types (Michal Schmidt) [RHEL-15652] - idpf: disable local BH when scheduling napi for marker packets (Michal Schmidt) [RHEL-15652] - idpf: remove dealloc vector msg err in idpf_intr_rel (Michal Schmidt) [RHEL-15652] - idpf: fix minor controlq issues (Michal Schmidt) [RHEL-15652] - idpf: prevent deinit uninitialized virtchnl core (Michal Schmidt) [RHEL-15652] - idpf: cleanup virtchnl cruft (Michal Schmidt) [RHEL-15652] - idpf: refactor idpf_recv_mb_msg (Michal Schmidt) [RHEL-15652] - idpf: add async_handler for MAC filter messages (Michal Schmidt) [RHEL-15652] - idpf: refactor remaining virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor queue related virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor vport virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: implement virtchnl transaction manager (Michal Schmidt) [RHEL-15652] - idpf: add idpf_virtchnl.h (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler padding in virtchnl2_ptype struct (Michal Schmidt) [RHEL-15652] - idpf: distinguish vports by the dev_port attribute (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler introduced padding in virtchnl2_rss_key struct (Michal Schmidt) [RHEL-15652] - idpf: fix corrupted frames and skb leaks in singleq mode (Michal Schmidt) [RHEL-15652] - idpf: refactor some missing field get/prep conversions (Michal Schmidt) [RHEL-15652] - idpf: add get/set for Ethtool's header split ringparam (Michal Schmidt) [RHEL-15652] - idpf: fix potential use-after-free in idpf_tso() (Michal Schmidt) [RHEL-15652] - idpf: cancel mailbox work in error path (Michal Schmidt) [RHEL-15652] - idpf: set scheduling mode for completion queue (Michal Schmidt) [RHEL-15652] - idpf: add SRIOV support and other ndo_ops (Michal Schmidt) [RHEL-15652] - idpf: add ethtool callbacks (Michal Schmidt) [RHEL-15652] - idpf: add singleq start_xmit and napi poll (Michal Schmidt) [RHEL-15652] - idpf: add RX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add TX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add splitq start_xmit (Michal Schmidt) [RHEL-15652] - idpf: initialize interrupts and enable vport (Michal Schmidt) [RHEL-15652] - idpf: configure resources for RX queues (Michal Schmidt) [RHEL-15652] - idpf: configure resources for TX queues (Michal Schmidt) [RHEL-15652] - idpf: add ptypes and MAC filter support (Michal Schmidt) [RHEL-15652] - idpf: add create vport and netdev configuration (Michal Schmidt) [RHEL-15652] - idpf: add core init and interrupt request (Michal Schmidt) [RHEL-15652] - idpf: add controlq init and reset checks (Michal Schmidt) [RHEL-15652] - idpf: add module register and probe functionality (Michal Schmidt) [RHEL-15652] - virtchnl: add virtchnl version 2 ops (Michal Schmidt) [RHEL-15652] - net: netdev_queue: netdev_txq_completed_mb(): fix wake condition (Michal Schmidt) [RHEL-15652] - net: piggy back on the memory barrier in bql when waking queues (Michal Schmidt) [RHEL-15652] - net: provide macros for commonly copied lockless queue stop/wake code (Michal Schmidt) [RHEL-15652] - [rt] build kernel-rt-4.18.0-552.1.1.rt7.342.el8_10 [RHEL-34640] - build: Update RTBZ for 8.10 z-stream builds (Denys Vlasenko) - redhat: set DIST to el8_10 and ZSTREAM to yes for 8.10 (Denys Vlasenko) - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (Prarit Bhargava) [RHEL-32590] {CVE-2021-47185} - net: mana: Fix Rx DMA datasize and skb_over_panic (Cathy Avery) [RHEL-32579] - RDMA/srpt: Support specifying the srpt_service_guid parameter (Kamal Heib) [RHEL-31710] {CVE-2024-26744} - RDMA/qedr: Fix qedr_create_user_qp error flow (Kamal Heib) [RHEL-31714] {CVE-2024-26743} - hwmon: (coretemp) Fix out-of-bounds memory access (David Arcari) [RHEL-31305] {CVE-2024-26664} - RDMA/irdma: Fix KASAN issue with tasklet (Kamal Heib) [RHEL-15776] - net: bridge: use DEV_STATS_INC() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: Fix unwanted sign extension in netdev_stats_to_stats64() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: add atomic_long_t to net_device_stats fields (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net/sched: act_ct: fix skb leak and crash on ooo frags (Xin Long) [RHEL-29467] {CVE-2023-52610} - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Jose Ignacio Tornos Martinez) [RHEL-28015] {CVE-2023-52528} - RDMA/core: Fix uninit-value access in ib_get_eth_speed() (Kamal Heib) [RHEL-30130] - RDMA/core: Get IB width and speed from netdev (Kamal Heib) [RHEL-30130] - cpufreq: intel_pstate: Add Emerald Rapids support in no-HWP mode (Prarit Bhargava) [RHEL-29444] - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add (Mamatha Inamdar) [RHEL-29118] {CVE-2023-52607} - powerpc/lib: Validate size for vector operations (Mamatha Inamdar) [RHEL-29114] {CVE-2023-52606} - usb: hub: Guard against accesses to uninitialized BOS descriptors (Desnes Nunes) [RHEL-28986] {CVE-2023-52477} - media: uvcvideo: Fix OOB read (Desnes Nunes) [RHEL-27940] {CVE-2023-52565} - media: pvrusb2: fix use after free on context disconnection (Desnes Nunes) [RHEL-26498] {CVE-2023-52445} - i2c: i801: Fix block process call transactions (Prarit Bhargava) [RHEL-26478] {CVE-2024-26593} - overlay: disable EVM (Coiby Xu) [RHEL-19863] - evm: add support to disable EVM on unsupported filesystems (Coiby Xu) [RHEL-19863] - evm: don't copy up 'security.evm' xattr (Coiby Xu) [RHEL-19863] - net: ena: Remove ena_select_queue (Kamal Heib) [RHEL-14286] - media: dvbdev: Fix memory leak in dvb_media_device_free() (Prarit Bhargava) [RHEL-27254] {CVE-2020-36777} - gfs2: Fix invalid metadata access in punch_hole (Andrew Price) [RHEL-28784] - i2c: Fix a potential use after free (Prarit Bhargava) [RHEL-26849] {CVE-2019-25162} - i2c: validate user data in compat ioctl (Prarit Bhargava) [RHEL-27022] {CVE-2021-46934} - platform/x86: think-lmi: Fix reference leak (Prarit Bhargava) [RHEL-28030] {CVE-2023-52520} - vhost: use kzalloc() instead of kmalloc() followed by memset() (Jon Maloy) [RHEL-21505] {CVE-2024-0340} - RDMA/siw: Fix connection failure handling (Kamal Heib) [RHEL-28042] {CVE-2023-52513} - vt: fix memory overlapping when deleting chars in the buffer (Waiman Long) [RHEL-27778 RHEL-27779] {CVE-2022-48627} - x86/fpu: Stop relying on userspace for info to fault in xsave buffer (Steve Best) [RHEL-26669] {CVE-2024-26603} - mptcp: fix double-free on socket dismantle (Davide Caratti) [RHEL-22773] {CVE-2024-26782} - crypto: akcipher - Disable signing and decryption (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: akcipher - default implementations for request callbacks (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: testmgr - split akcipher tests by a key type (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - workqueue: Warn when a rescuer could not be created (Waiman Long) [RHEL-22136] - RDMA/cma: Avoid GID lookups on iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/cma: Deduplicate error flow in cma_validate_port() (Benjamin Coddington) [RHEL-12456] - RDMA/core: Set gid_attr.ndev for iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/siw: Fabricate a GID on tun and loopback devices (Benjamin Coddington) [RHEL-12456] - eventpoll: fix missing wakeup for ovflist in ep_poll_callback (Luis Claudio R. Goncalves) [RHEL-23022] - [rt] build kernel-rt-4.18.0-552.rt7.341.el8 [RHEL-5332] - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248] - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248] - [rt] build kernel-rt-4.18.0-551.rt7.340.el8 [RHEL-5332] - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742} - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992] - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825} - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237] - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724} - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513} - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921] - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921] - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921] - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921] - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921] - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774] - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660] - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660] - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199] - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539} - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825} - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237] - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724} - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513} - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921] - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921] - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921] - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921] - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921] - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285} - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993} - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396] - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396] - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396] - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396] - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355] - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355] - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355] - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355] - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355] - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355] - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240} - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek) - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963] - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171] - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171] - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226] - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226] - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744] - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744] - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744] - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744] - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew) [RHEL-129945] - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774] - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660] - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660] - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199] - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539} - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825} - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237] - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724} - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513} - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921] - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921] - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921] - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921] - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921] - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301} - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933} - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051} - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449] - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096} - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285} - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993} - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396] - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396] - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396] - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396] - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355] - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355] - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355] - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355] - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355] - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355] - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240} - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek) - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963] - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171] - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171] - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226] - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226] - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744] - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744] - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744] - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744] - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew) [RHEL-129945] - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774] - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660] - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660] - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199] - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539} - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - Bluetooth: hci_event: call disconnect callback before deleting conn (CKI Backport Bot) [RHEL-137039] {CVE-2023-53673} - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CKI Backport Bot) [RHEL-134423] {CVE-2025-40277} - xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 (John J Coleman) [RHEL-111354] - xen: Fix x86 sched_clock() interface for xen (John J Coleman) [RHEL-111354] - x86/xen/time: Output xen sched_clock time from 0 (John J Coleman) [RHEL-111354] - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Olga Kornievskaia) [RHEL-132819] - vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139273] {CVE-2025-40248} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ignore ndlp rport mismatch in dev_loss_tmo callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Modify handling of ADISC based on ndlp state and RPI registration (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Delete NLP_TARGET_REMOVE flag due to obsolete usage (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo callback (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Check devloss callbk done flag for potential stale NDLP ptrs (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kref imbalance on fabric ndlps from dev_loss_tmo handler (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Update PRLO handling in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Add condition to delete ndlp object after sending BLS_RJT to an ABTS (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove NLP_RCV_PLOGI early return during RSCN processing for ndlps (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Allow lpfc_plogi_confirm_nport() logic to execute for Fabric nodes (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix list_entry null check warning in lpfc_cmpl_els_plogi() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix possible file string name overflow when updating firmware (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Validate ELS LS_ACC completion payload (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove extra ndlp kref decrement in FLOGI cmpl for loop topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Revise NPIV ELS unsol rcv cmpl logic to drop ndlp based on nlp_state (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix double free in lpfc_cmpl_els_logo_acc() caused by lpfc_nlp_not_used() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Move scsi_host_template outside dynamically allocated/freed phba (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fill in missing ndlp kref puts in error paths (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login (Ewan D. Milne) [RHEL-32324] - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301} - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933} - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051} - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449] - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096} - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285} - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993} - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396] - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396] - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396] - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396] - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355] - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355] - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355] - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355] - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355] - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355] - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240} - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek) - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963] - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171] - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171] - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226] - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226] - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744] - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744] - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744] - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744] - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew) [RHEL-129945] - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117] - [rt] build kernel-rt-4.18.0-552.rt7.341.el8 [RHEL-5332] - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248] - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248] - [rt] build kernel-rt-4.18.0-551.rt7.340.el8 [RHEL-5332] - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742} - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992] - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992] - [rt] build kernel-rt-4.18.0-550.rt7.339.el8 [RHEL-5332] - mm/sparsemem: fix race in accessing memory_section->usage (Waiman Long) [RHEL-28875 RHEL-28876] {CVE-2023-52489} - mm: use __pfn_to_section() instead of open coding it (Waiman Long) [RHEL-28875] {CVE-2023-52489} - [rt] build kernel-rt-4.18.0-549.rt7.338.el8 [RHEL-5332] - dm-integrity: align the outgoing bio in integrity_recheck (Benjamin Marzinski) [RHEL-29678] - dm-integrity: fix a memory leak when rechecking the data (Benjamin Marzinski) [RHEL-29678] - RDMA/mana_ib: Add CQ interrupt support for RAW QP (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: query device capabilities (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: register RDMA device with GDMA (Maxim Levitsky) [RHEL-23934] - net: mana: add msix index sharing between EQs (Maxim Levitsky) [RHEL-23934] - net: mana: Fix spelling mistake "enforecement" -> "enforcement" (Maxim Levitsky) [RHEL-23934] - net :mana :Add remaining GDMA stats for MANA to ethtool (Maxim Levitsky) [RHEL-23934] - net: mana: Fix oversized sge0 for GSO packets (Maxim Levitsky) [RHEL-23934] - net: mana: Fix TX CQE error handling (Maxim Levitsky) [RHEL-23934] - net: mana: Add gdma stats to ethtool output for mana (Maxim Levitsky) [RHEL-23934] - net: mana: Fix MANA VF unload when hardware is unresponsive (Maxim Levitsky) [RHEL-23934] - net: mana: Configure hwc timeout from hardware (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (Maxim Levitsky) [RHEL-23934] - [rt] build kernel-rt-4.18.0-548.rt7.337.el8 [RHEL-5332] - gitlab-ci: enable arm64/s390x/ppc64le debug builds (Michael Hofmann) - arm64: Add missing bits of AmpereOne Spectre-BHB mitigation (Mark Salter) [RHEL-29005] - [rt] enable CONFIG_DRM_MGAG200_IOBURST_WORKAROUND (Jocelyn Falempe) [RHEL-13214] - drm/mgag200: Add a workaround for low-latency (Jocelyn Falempe) [RHEL-13214] - [rt] build kernel-rt-4.18.0-547.rt7.336.el8 [RHEL-5332] - x86/efistub: Avoid placing the kernel below LOAD_PHYSICAL_ADDR (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Give up if memory attribute protocol returns an error (Lenny Szubowicz) [RHEL-2505] - x86/boot: Increase section and file alignment to 4k/512 (Lenny Szubowicz) [RHEL-2505] - x86/boot: Split off PE/COFF .data section (Lenny Szubowicz) [RHEL-2505] - x86/boot: Drop PE/COFF .reloc section (Lenny Szubowicz) [RHEL-2505] - x86/boot: Construct PE/COFF .text section from assembler (Lenny Szubowicz) [RHEL-2505] - x86/boot: Derive file size from _edata symbol (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed: Remove, discard, or assert for unwanted sections (Lenny Szubowicz) [RHEL-2505] - x86/boot: Check that there are no run-time relocations (Lenny Szubowicz) [RHEL-2505] - x86/boot: Discard .discard.unreachable for arch/x86/boot/compressed/vmlinux (Lenny Szubowicz) [RHEL-2505] - x86/boot: Define setup size in linker script (Lenny Szubowicz) [RHEL-2505] - x86/boot: Set EFI handover offset directly in header asm (Lenny Szubowicz) [RHEL-2505] - x86/boot: Drop references to startup_64 (Lenny Szubowicz) [RHEL-2505] - x86/boot: Drop redundant code setting the root device (Lenny Szubowicz) [RHEL-2505] - x86/build: Declutter the build output (Lenny Szubowicz) [RHEL-2505] - x86/boot: Omit compression buffer from PE/COFF image memory footprint (Lenny Szubowicz) [RHEL-2505] - x86/boot: Mark global variables as static (Lenny Szubowicz) [RHEL-2505] - efi/x86: Remove extra headroom for setup block (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove the 'bugger off' message (Lenny Szubowicz) [RHEL-2505] - x86/efi: Drop alignment flags from PE section headers (Lenny Szubowicz) [RHEL-2505] - efi: Put Linux specific magic number in the DOS header (Lenny Szubowicz) [RHEL-2505] - efi/x86: Fix the missing KASLR_FLAG bit in boot_params->hdr.loadflags (Lenny Szubowicz) [RHEL-2505] - efi/x86: Avoid physical KASLR on older Dell systems (Lenny Szubowicz) [RHEL-2505] - x86/boot: efistub: Assign global boot_params variable (Lenny Szubowicz) [RHEL-2505] - x86/boot: Rename conflicting 'boot_params' pointer to 'boot_params_ptr' (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Avoid legacy decompressor when doing EFI boot (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Perform SNP feature test while running in the firmware (Lenny Szubowicz) [RHEL-2505] - x86/sev: Do not try to parse for the CC blob on non-AMD hardware (Lenny Szubowicz) [RHEL-2505] - efi/libstub: Add limit argument to efi_random_alloc() (Lenny Szubowicz) [RHEL-2505] - arm64: efi: Limit allocations to 48-bit addressable physical region (Lenny Szubowicz) [RHEL-2505] - efi: libstub: use EFI_LOADER_CODE region when moving the kernel in memory (Lenny Szubowicz) [RHEL-2505] - arm64: efi: kaslr: Fix occasional random alloc (and boot) failure (Lenny Szubowicz) [RHEL-2505] - efi/libstub/random: Increase random alloc granularity (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Factor out kernel decompression and relocation (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Move global symbol references to C code (Lenny Szubowicz) [RHEL-2505] - decompress: Use 8 byte alignment (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Prefer EFI memory attributes protocol over DXE services (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Perform 4/5 level paging switch from the stub (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Merge trampoline cleanup with switching code (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Pass pgtable address to trampoline directly (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Only call the trampoline when changing paging levels (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Call trampoline directly from C code (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Avoid the need for a stack in the 32-bit trampoline (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Use standard calling convention for trampoline (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Call trampoline as a normal function (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Remove .bss/.pgtable from bzImage (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove run-time relocations from .head.text code (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Assign paging related global variables earlier (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Store boot_params pointer in callee save register (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Clear BSS in EFI handover protocol entrypoint (Lenny Szubowicz) [RHEL-2505] - x86/head_64: Store boot_params pointer in callee save register (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Don't rely on upper 32 bits of GPRs being preserved (Lenny Szubowicz) [RHEL-2505] - x86/head/64: Switch to KERNEL_CS as soon as new GDT is installed (Lenny Szubowicz) [RHEL-2505] - efi/libstub: Add memory attribute protocol definitions (Lenny Szubowicz) [RHEL-2505] - efi/x86: libstub: remove unused variable (Lenny Szubowicz) [RHEL-2505] - x86/boot: Robustify calling startup_{32,64}() from the decompressor code (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Simplify and clean up handover entry code (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Branch straight to kernel entry point from C code (Lenny Szubowicz) [RHEL-2505] - efi/x86: Avoid using code32_start (Lenny Szubowicz) [RHEL-2505] - efi/libstub/x86: Use Exit() boot service to exit the stub on errors (Lenny Szubowicz) [RHEL-2505] - efi: x86: Wipe setup_data on pure EFI boot (Lenny Szubowicz) [RHEL-2505] - efi: x86: Fix config name for setting the NX-compatibility flag in the PE header (Lenny Szubowicz) [RHEL-2505] - efi: x86: Set the NX-compatibility flag in the PE header (Lenny Szubowicz) [RHEL-2505] - efi/x86: Add kernel preferred address to PE header (Lenny Szubowicz) [RHEL-2505] - efi/x86: Use symbolic constants in PE header instead of bare numbers (Lenny Szubowicz) [RHEL-2505] - efi/x86: Drop redundant .bss section (Lenny Szubowicz) [RHEL-2505] - efi/x86: add headroom to decompressor BSS to account for setup block (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove run-time relocations from head_{32,64}.S (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed: Fix debug_puthex() parameter type (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Use 32-bit (zero-extended) MOV for z_output_len (Lenny Szubowicz) [RHEL-2505] - x86/boot: Use unsigned comparison for addresses (Lenny Szubowicz) [RHEL-2505] - x86/boot: Micro-optimize GDT loading instructions (Lenny Szubowicz) [RHEL-2505] - x86/boot: GDT limit value should be size - 1 (Lenny Szubowicz) [RHEL-2505] - efi/x86: Remove GDT setup from efi_main (Lenny Szubowicz) [RHEL-2505] - x86/boot: Clear direction and interrupt flags in startup_64 (Lenny Szubowicz) [RHEL-2505] - efi/x86: Don't depend on firmware GDT layout (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove KEEP_SEGMENTS support (Lenny Szubowicz) [RHEL-2505] - x86/boot: Handle malformed SRAT tables during early ACPI parsing (Lenny Szubowicz) [RHEL-2505] - efi/libstub/x86: Use mandatory 16-byte stack alignment in mixed mode (Lenny Szubowicz) [RHEL-2505] - efi/libstub/x86: Avoid globals to store context during mixed mode calls (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Disable paging at mixed mode entry (Lenny Szubowicz) [RHEL-2505] - x86: efi/random: Invoke EFI_RNG_PROTOCOL to seed the UEFI RNG table (Lenny Szubowicz) [RHEL-2505] - x86/asm: Make some functions local (Lenny Szubowicz) [RHEL-2505] - x86/boot: Annotate data appropriately (Lenny Szubowicz) [RHEL-2505] - x86/boot: Annotate local functions (Lenny Szubowicz) [RHEL-2505] - x86/asm: Make more symbols local (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Fix missing initialization in find_trampoline_placement() (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Fix boot on machines with broken E820 table (Lenny Szubowicz) [RHEL-2505] - x86, boot: Remove multiple copy of static function sanitize_boot_params() (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Remove unused variable (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Explain paging_prepare()'s return value (Lenny Szubowicz) [RHEL-2505] - x86/boot: Save several bytes in decompressor (Lenny Szubowicz) [RHEL-2505] - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (Audra Mitchell) [RHEL-20614] {CVE-2024-0841} - net/gve: update check for little-endianness in gve kconfig (Joshua Washington) [RHEL-29030] - [rt] build kernel-rt-4.18.0-546.rt7.335.el8 [RHEL-5332] - sched/membarrier: reduce the ability to hammer on sys_membarrier (Wander Lairson Costa) [RHEL-23430] {CVE-2024-26602} - NFS: Set the stable writes flag when initialising the super block (Benjamin Coddington) [RHEL-25266] - smb: client: fix OOB in receive_encrypted_standard() (Scott Mayhew) [RHEL-21685] {CVE-2024-0565} - scsi: core: Move scsi_host_busy() out of host lock if it is for per-command (Ming Lei) [RHEL-23942] - scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler (Ming Lei) [RHEL-23942] - gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump (Andrew Price) [RHEL-26501] {CVE-2023-52448} - smb: client: fix parsing of SMB3.1.1 POSIX create context (Paulo Alcantara) [RHEL-26241] {CVE-2023-52434} - smb: client: fix potential OOBs in smb2_parse_contexts() (Paulo Alcantara) [RHEL-26241] {CVE-2023-52434} - smb3: Replace smb2pdu 1-element arrays with flex-arrays (Jay Shin) [RHEL-22143] - cifs: Replace remaining 1-element arrays (Jay Shin) [RHEL-22143] - cifs: Convert struct fealist away from 1-element array (Jay Shin) [RHEL-22143] - cifs: remove unneeded 2bytes of padding from smb2 tree connect (Jay Shin) [RHEL-22143] - cifs: Replace zero-length arrays with flexible-array members (Jay Shin) [RHEL-22143] - cifs: Replace a couple of one-element arrays with flexible-array members (Jay Shin) [RHEL-22143] - cifs: fix FILE_BOTH_DIRECTORY_INFO definition (Jay Shin) [RHEL-22143] - nfsd: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - nfs: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - lockd: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - cifs: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - ceph: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - filelock: add a new locks_inode_context accessor function (Jeffrey Layton) [RHEL-27441] - dm-integrity, dm-verity: reduce stack usage for recheck (Benjamin Marzinski) [RHEL-27849] - dm-crypt: recheck the integrity tag after a failure (Benjamin Marzinski) [RHEL-27849] - dm-crypt: don't modify the data when using authenticated encryption (Benjamin Marzinski) [RHEL-27849] - dm-verity: recheck the hash after a failure (Benjamin Marzinski) [RHEL-27849] - dm-integrity: recheck the integrity tag after a failure (Benjamin Marzinski) [RHEL-27849] - [rt] build kernel-rt-4.18.0-545.rt7.334.el8 [RHEL-5332] - tracing/timerlat: Move hrtimer_init to timerlat_fd open() (John Kacur) [RHEL-26667] - tracing/perf: Fix double put of trace event when init fails (Michael Petlan) [RHEL-19537] - ipvlan: Add handling of NETDEV_UP events (Hangbin Liu) [RHEL-19098] - ceph: add ceph_cap_unlink_work to fire check_caps() immediately (Xiubo Li) [RHEL-21760] - ceph: always queue a writeback when revoking the Fb caps (Xiubo Li) [RHEL-21760] - ceph: always check dir caps asynchronously (Xiubo Li) [RHEL-21760] - nfs: fix redundant readdir request after get eof (Benjamin Coddington) [RHEL-7780] - NFSv4.1: fixup use EXCHGID4_FLAG_USE_PNFS_DS for DS server (Scott Mayhew) [RHEL-7994] - NFSv4.1: fix pnfs MDS=DS session trunking (Scott Mayhew) [RHEL-7994] - NFSv4.1: fix zero value filehandle in post open getattr (Scott Mayhew) [RHEL-7994] - NFSv4.1: use EXCHGID4_FLAG_USE_PNFS_DS for DS server (Scott Mayhew) [RHEL-7994] - x86/boot: Ignore NMIs during very early boot (Valentin Schneider) [RHEL-22749] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - vfs: use READ_ONCE() to access ->i_link (Jay Shin) [RHEL-141790] - fold generic_readlink() into its only caller (Jay Shin) [RHEL-141790] - fs/proc: fix uaf in proc_readdir_de() (Pavel Reichl) [RHEL-137093] {CVE-2025-40271} - Backport 'create an empty changelog file when changing its name' (Alexandra Hájková) - mptcp: fix race condition in mptcp_schedule_work() (Paolo Abeni) [RHEL-134443] {CVE-2025-40258} - mptcp: use mptcp_schedule_work instead of open-coding it (Paolo Abeni) [RHEL-134443] - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - tcp: minor optimization in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Kamal Heib) [RHEL-134347] {CVE-2025-38022} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - Bluetooth: hci_event: call disconnect callback before deleting conn (CKI Backport Bot) [RHEL-137039] {CVE-2023-53673} - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CKI Backport Bot) [RHEL-134423] {CVE-2025-40277} - xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 (John J Coleman) [RHEL-111354] - xen: Fix x86 sched_clock() interface for xen (John J Coleman) [RHEL-111354] - x86/xen/time: Output xen sched_clock time from 0 (John J Coleman) [RHEL-111354] - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Olga Kornievskaia) [RHEL-132819] - vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139273] {CVE-2025-40248} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ignore ndlp rport mismatch in dev_loss_tmo callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Modify handling of ADISC based on ndlp state and RPI registration (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Delete NLP_TARGET_REMOVE flag due to obsolete usage (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo callback (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Check devloss callbk done flag for potential stale NDLP ptrs (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kref imbalance on fabric ndlps from dev_loss_tmo handler (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Update PRLO handling in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Add condition to delete ndlp object after sending BLS_RJT to an ABTS (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove NLP_RCV_PLOGI early return during RSCN processing for ndlps (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Allow lpfc_plogi_confirm_nport() logic to execute for Fabric nodes (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix list_entry null check warning in lpfc_cmpl_els_plogi() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix possible file string name overflow when updating firmware (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Validate ELS LS_ACC completion payload (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove extra ndlp kref decrement in FLOGI cmpl for loop topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Revise NPIV ELS unsol rcv cmpl logic to drop ndlp based on nlp_state (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix double free in lpfc_cmpl_els_logo_acc() caused by lpfc_nlp_not_used() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Move scsi_host_template outside dynamically allocated/freed phba (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fill in missing ndlp kref puts in error paths (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login (Ewan D. Milne) [RHEL-32324] - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301} - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933} - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051} - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449] - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096} - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - vfs: use READ_ONCE() to access ->i_link (Jay Shin) [RHEL-141790] - fold generic_readlink() into its only caller (Jay Shin) [RHEL-141790] - fs/proc: fix uaf in proc_readdir_de() (Pavel Reichl) [RHEL-137093] {CVE-2025-40271} - Backport 'create an empty changelog file when changing its name' (Alexandra Hájková) - mptcp: fix race condition in mptcp_schedule_work() (Paolo Abeni) [RHEL-134443] {CVE-2025-40258} - mptcp: use mptcp_schedule_work instead of open-coding it (Paolo Abeni) [RHEL-134443] - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - tcp: minor optimization in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Kamal Heib) [RHEL-134347] {CVE-2025-38022} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - vfs: use READ_ONCE() to access ->i_link (Jay Shin) [RHEL-141790] - fold generic_readlink() into its only caller (Jay Shin) [RHEL-141790] - fs/proc: fix uaf in proc_readdir_de() (Pavel Reichl) [RHEL-137093] {CVE-2025-40271} - Backport 'create an empty changelog file when changing its name' (Alexandra Hájková) - mptcp: fix race condition in mptcp_schedule_work() (Paolo Abeni) [RHEL-134443] {CVE-2025-40258} - mptcp: use mptcp_schedule_work instead of open-coding it (Paolo Abeni) [RHEL-134443] - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - tcp: minor optimization in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Kamal Heib) [RHEL-134347] {CVE-2025-38022} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - autofs: use wake_up() instead of wake_up_interruptible(() (Ian Kent) [RHEL-143685] - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Ian Kent) [RHEL-143685] {CVE-2023-54134} - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141709] - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-136693] - audit: merge loops in __audit_inode_child() (Ricardo Robaina) [RHEL-140442] - bridge: mcast: Fix use-after-free during router port configuration (Mohammad Heib) [RHEL-138422] {CVE-2025-38248} - net/sched: Enforce that teql can only be used as root qdisc (CKI Backport Bot) [RHEL-146992] {CVE-2026-23074} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Marc Milgram) [RHEL-137838] {CVE-2025-38129} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143189] {CVE-2025-68800} - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126886] {CVE-2025-40064} - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147261] {CVE-2026-23097} - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-134673] - autofs: use wake_up() instead of wake_up_interruptible(() (Ian Kent) [RHEL-143685] - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Ian Kent) [RHEL-143685] {CVE-2023-54134} - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141709] - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-136693] - audit: merge loops in __audit_inode_child() (Ricardo Robaina) [RHEL-140442] - bridge: mcast: Fix use-after-free during router port configuration (Mohammad Heib) [RHEL-138422] {CVE-2025-38248} - net/sched: Enforce that teql can only be used as root qdisc (CKI Backport Bot) [RHEL-146992] {CVE-2026-23074} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Marc Milgram) [RHEL-137838] {CVE-2025-38129} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143189] {CVE-2025-68800} - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126886] {CVE-2025-40064} - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - macvlan: fix possible UAF in macvlan_forward_source() (Hangbin Liu) [RHEL-144120] {CVE-2026-23001} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-131922] - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount (Jocelyn Falempe) [RHEL-148636] - audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd references (Waiman Long) [RHEL-146026] - fs: Add a pool of extra fs->pwd references to fs_struct (Waiman Long) [RHEL-146026] - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143535] {CVE-2025-71085} - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147261] {CVE-2026-23097} - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-134673] - autofs: use wake_up() instead of wake_up_interruptible(() (Ian Kent) [RHEL-143685] - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Ian Kent) [RHEL-143685] {CVE-2023-54134} - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141709] - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-136693] - audit: merge loops in __audit_inode_child() (Ricardo Robaina) [RHEL-140442] - bridge: mcast: Fix use-after-free during router port configuration (Mohammad Heib) [RHEL-138422] {CVE-2025-38248} - net/sched: Enforce that teql can only be used as root qdisc (CKI Backport Bot) [RHEL-146992] {CVE-2026-23074} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Marc Milgram) [RHEL-137838] {CVE-2025-38129} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143189] {CVE-2025-68800} - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126886] {CVE-2025-40064} - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - x86/microcode/AMD: Revert "Backport AMD microcode commits for better microcode loading support" (Waiman Long) [RHEL-155860] - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150398] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150398] - tcp: fix forever orphan socket caused by tcp_abort (Paolo Abeni) [RHEL-146187] - xfs: fix minimum agno handling for xfs alloc modes in RHEL8 (Brian Foster) [RHEL-102464] - xfs: fix uninitialized use of flags variable in xfs_alloc_vextent() (Brian Foster) [RHEL-102464] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82523] - tcp: use this_cpu_read(*X) instead of *this_cpu_ptr(X) (Davide Caratti) [RHEL-82523] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150221] - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150221] {CVE-2026-23209} - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) [RHEL-96016] - s390/kexec: Emit an error message when cmdline is too long (Mete Durlu) [RHEL-144946] - s390/boot: Fix kernel size in bootparm area (Mete Durlu) [RHEL-144946] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-137123] - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-151614] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove useless transaction in evict_linked_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-151614] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-151614] - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146419] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146419] {CVE-2025-38323} - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136288] - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136288] - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136288] - scsi: st: Tighten the page format heuristics with MODE SELECT (John Meneghini) [RHEL-136288] - scsi: st: ERASE does not change tape location (John Meneghini) [RHEL-136288] - scsi: st: Fix array overflow in st_setup() (John Meneghini) [RHEL-136288] - scsi: st: Add sysfs file position_lost_in_reset (John Meneghini) [RHEL-136288] - scsi: st: Modify st.c to use the new scsi_error counters (John Meneghini) [RHEL-136288] - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (John Meneghini) [RHEL-136288] - scsi: st: Restore some drive settings after reset (John Meneghini) [RHEL-136288] - scsi: st: Fix input/output error on empty drive reset (John Meneghini) [RHEL-136288] - smb: client: handle lack of IPC in dfs_cache_refresh() (Paulo Alcantara) [RHEL-138235] - smb: client: allow parsing zero-length AV pairs (Paulo Alcantara) [RHEL-138235] - cifs: reduce warning log level for server not advertising interfaces (Paulo Alcantara) [RHEL-138235] - smb: client: Fix match_session bug preventing session reuse (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of kstrdup() in get_ses_refpath() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy when tree connecting to DFS interlink targets (Paulo Alcantara) [RHEL-138235] - smb: client: don't trust DFSREF_STORAGE_SERVER bit (Paulo Alcantara) [RHEL-138235] - smb: client: don't check for @leaf_fullpath in match_server() (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of TCP_Server_Info::refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: don't retry DFS targets on server shutdown (Paulo Alcantara) [RHEL-138235] - smb: client: fix return value of parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: optimize referral walk on failed link targets (Paulo Alcantara) [RHEL-138235] - smb: client: provide dns_resolve_{unc,name} helpers (Paulo Alcantara) [RHEL-138235] - smb: client: parse DNS domain name from domain= option (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS mount against old servers with NTLMSSP (Paulo Alcantara) [RHEL-138235] - smb: client: parse av pair type 4 in CHALLENGE_MESSAGE (Paulo Alcantara) [RHEL-138235] - smb: client: introduce av_for_each_entry() helper (Paulo Alcantara) [RHEL-138235] - smb: client: fix double free of TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-138235] {CVE-2025-21673} - smb: client: fix potential race in cifs_put_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy message when mounting shares (Paulo Alcantara) [RHEL-138235] - smb: client: don't try following DFS links in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow reconnect when sending ioctl (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of @nlsc param in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow more DFS referrals to be cached (Paulo Alcantara) [RHEL-138235] - smb: client: propagate error from cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS failover in multiuser mounts (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS interlink failover (Paulo Alcantara) [RHEL-138235] - smb: client: improve purging of cached referrals (Paulo Alcantara) [RHEL-138235] - smb: client: avoid unnecessary reconnects when refreshing referrals (Paulo Alcantara) [RHEL-138235] - smb: client: serialise cifs_construct_tcon() with cifs_mount_mutex (Paulo Alcantara) [RHEL-138235] - smb: client: handle DFS tcons in cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: refresh referral without acquiring refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: guarantee refcounted children from parent session (Paulo Alcantara) [RHEL-138235] {CVE-2024-35869} - smb: client: set correct id, uid and cruid for multiuser automounts (Paulo Alcantara) [RHEL-138235] {CVE-2024-26822} - cifs: change tcon status when need_reconnect is set on it (Paulo Alcantara) [RHEL-138235] - smb: client: fix potential NULL deref in parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: fix mount when dns_resolver key is not available (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs code dep in namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs naming in automount code (Paulo Alcantara) [RHEL-138235] - smb: client: rename cifs_dfs_ref.c to namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: ensure to try all targets when finding nested links (Paulo Alcantara) [RHEL-138235] - smb: client: introduce DFS_CACHE_TGT_LIST() (Paulo Alcantara) [RHEL-138235] - smb: client: fix null auth (Paulo Alcantara) [RHEL-138235] - smb: client: fix dfs link mount against w2k8 (Paulo Alcantara) [RHEL-138235] - cifs: fix charset issue in reconnection (Paulo Alcantara) [RHEL-138235] - smb: client: fix missed ses refcounting (Paulo Alcantara) [RHEL-138235] {CVE-2023-54076} - fs/nls: make load_nls() take a const parameter (Paulo Alcantara) [RHEL-138235] - smb: client: remove redundant pointer 'server' (Paulo Alcantara) [RHEL-138235] - smb: client: improve DFS mount check (Paulo Alcantara) [RHEL-138235] - smb: client: fix shared DFS root mounts with different prefixes (Paulo Alcantara) [RHEL-138235] - smb: client: fix parsing of source mount option (Paulo Alcantara) [RHEL-138235] - smb: client: fix warning in cifs_match_super() (Paulo Alcantara) [RHEL-138235] - cifs: fix max_credits implementation (Paulo Alcantara) [RHEL-138235] - cifs: fix sockaddr comparison in iface_cmp (Paulo Alcantara) [RHEL-138235] - cifs: fix status checks in cifs_tree_connect (Paulo Alcantara) [RHEL-138235] - cifs: fix smb1 mount regression (Paulo Alcantara) [RHEL-138235] - cifs: fix sharing of DFS connections (Paulo Alcantara) [RHEL-138235] - cifs: avoid potential races when handling multiple dfs tcons (Paulo Alcantara) [RHEL-138235] - cifs: protect access of TCP_Server_Info::{origin,leaf}_fullpath (Paulo Alcantara) [RHEL-138235] - cifs: avoid dup prefix path in dfs_get_automount_devname() (Paulo Alcantara) [RHEL-138235] - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL (Paulo Alcantara) [RHEL-138235] {CVE-2023-53246} - smb3: fix unusable share after force unmount failure (Paulo Alcantara) [RHEL-138235] - cifs: check only tcon status on tcon related functions (Paulo Alcantara) [RHEL-138235] - cifs: return DFS root session id in DebugData (Paulo Alcantara) [RHEL-138235] - cifs: fix use-after-free bug in refresh_cache_worker() (Paulo Alcantara) [RHEL-138235] {CVE-2023-53052} - cifs: set DFS root session in cifs_get_smb_ses() (Paulo Alcantara) [RHEL-138235] - cifs: remove unused function (Paulo Alcantara) [RHEL-138235] - cifs: remove duplicate code in __refresh_tcon() (Paulo Alcantara) [RHEL-138235] - cifs: remove redundant assignment to the variable match (Paulo Alcantara) [RHEL-138235] - cifs: use origin fullpath for automounts (Paulo Alcantara) [RHEL-138235] - cifs: fix source pathname comparison of dfs supers (Paulo Alcantara) [RHEL-138235] - cifs: fix confusing debug message (Paulo Alcantara) [RHEL-138235] - cifs: don't block in dfs_cache_noreq_update_tgthint() (Paulo Alcantara) [RHEL-138235] - cifs: refresh root referrals (Paulo Alcantara) [RHEL-138235] - cifs: fix refresh of cached referrals (Paulo Alcantara) [RHEL-138235] - cifs: share dfs connections and supers (Paulo Alcantara) [RHEL-138235] - cifs: split out ses and tcon retrieval from mount_get_conns() (Paulo Alcantara) [RHEL-138235] - cifs: set resolved ip in sockaddr (Paulo Alcantara) [RHEL-138235] - cifs: remove unused smb3_fs_context::mount_options (Paulo Alcantara) [RHEL-138235] - cifs: get rid of mount options string parsing (Paulo Alcantara) [RHEL-138235] - cifs: use fs_context for automounts (Paulo Alcantara) [RHEL-138235] - cifs: remove various function description warnings (Paulo Alcantara) [RHEL-138235] - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Select which microcode patch to load (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add more known models to entry sign checking (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Limit Entrysign signature checking to known generations (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use sha256() instead of init/update/final (Waiman Long) [RHEL-132479] - x86/microcode: Fix Entrysign revision check for Zen1/Naples (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Handle the case of no BIOS microcode (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add some forgotten models to the SHA check (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Load only SHA256-checksummed patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add get_patch_level() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Merge early_apply_microcode() into its single callsite (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Have __apply_microcode_amd() return bool (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Flush patch buffer mapping after application (Waiman Long) [RHEL-132479] - x86/mm: Carve out INVLPG inline asm for use by others (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Split load_microcode_amd() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Pay attention to the stepping dynamically (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix a -Wsometimes-uninitialized clang false positive (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use the family,model,stepping encoded in the patch ID (Waiman Long) [RHEL-132479] - x86/microcode/amd: Cache builtin microcode too (Waiman Long) [RHEL-132479] - x86/microcode/amd: Use correct per CPU ucode_cpu_info (Waiman Long) [RHEL-132479] - x86/microcode/amd: Remove X86_32 specific code in early_apply_microcode() & get_builtin_microcode() (Waiman Long) [RHEL-132479] - x86/microcode: Move core specific defines to local header (Waiman Long) [RHEL-132479] - x86/microcode/intel: Rename get_datasize() since its used externally (Waiman Long) [RHEL-132479] - x86/microcode: Make reload_early_microcode() static (Waiman Long) [RHEL-132479] - x86/microcode: Include vendor headers into microcode.h (Waiman Long) [RHEL-132479] - x86/microcode/intel: Move microcode functions out of cpu/intel.c (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Get rid of __find_equiv_id() (Waiman Long) [RHEL-132479] - x86/microcode: Add explicit CPU vendor dependency (Waiman Long) [RHEL-132479] - macvlan: fix possible UAF in macvlan_forward_source() (Hangbin Liu) [RHEL-144120] {CVE-2026-23001} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-131922] - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount (Jocelyn Falempe) [RHEL-148636] - audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd references (Waiman Long) [RHEL-146026] - fs: Add a pool of extra fs->pwd references to fs_struct (Waiman Long) [RHEL-146026] - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143535] {CVE-2025-71085} - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147261] {CVE-2026-23097} - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-134673] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930] - NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242] - pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242] - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242] - NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242] - NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242] - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242] - SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242] - NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242] - SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242] - SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242] - SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242] - SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242] - NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242] - NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419] - nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419] - pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419] - NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419] - NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419] - NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419] - NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419] - NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419] - NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419] - NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419] - NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419] - NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419] - nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419] - nfs: always check dreq->error after a commit (Mike Snitzer) [RHEL-156419] - nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419] - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231} - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942] - x86/microcode/AMD: Revert "Backport AMD microcode commits for better microcode loading support" (Waiman Long) [RHEL-155860] - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150398] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150398] - tcp: fix forever orphan socket caused by tcp_abort (Paolo Abeni) [RHEL-146187] - xfs: fix minimum agno handling for xfs alloc modes in RHEL8 (Brian Foster) [RHEL-102464] - xfs: fix uninitialized use of flags variable in xfs_alloc_vextent() (Brian Foster) [RHEL-102464] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82523] - tcp: use this_cpu_read(*X) instead of *this_cpu_ptr(X) (Davide Caratti) [RHEL-82523] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150221] - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150221] {CVE-2026-23209} - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) [RHEL-96016] - s390/kexec: Emit an error message when cmdline is too long (Mete Durlu) [RHEL-144946] - s390/boot: Fix kernel size in bootparm area (Mete Durlu) [RHEL-144946] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-137123] - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-151614] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove useless transaction in evict_linked_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-151614] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-151614] - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146419] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146419] {CVE-2025-38323} - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136288] - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136288] - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136288] - scsi: st: Tighten the page format heuristics with MODE SELECT (John Meneghini) [RHEL-136288] - scsi: st: ERASE does not change tape location (John Meneghini) [RHEL-136288] - scsi: st: Fix array overflow in st_setup() (John Meneghini) [RHEL-136288] - scsi: st: Add sysfs file position_lost_in_reset (John Meneghini) [RHEL-136288] - scsi: st: Modify st.c to use the new scsi_error counters (John Meneghini) [RHEL-136288] - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (John Meneghini) [RHEL-136288] - scsi: st: Restore some drive settings after reset (John Meneghini) [RHEL-136288] - scsi: st: Fix input/output error on empty drive reset (John Meneghini) [RHEL-136288] - smb: client: handle lack of IPC in dfs_cache_refresh() (Paulo Alcantara) [RHEL-138235] - smb: client: allow parsing zero-length AV pairs (Paulo Alcantara) [RHEL-138235] - cifs: reduce warning log level for server not advertising interfaces (Paulo Alcantara) [RHEL-138235] - smb: client: Fix match_session bug preventing session reuse (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of kstrdup() in get_ses_refpath() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy when tree connecting to DFS interlink targets (Paulo Alcantara) [RHEL-138235] - smb: client: don't trust DFSREF_STORAGE_SERVER bit (Paulo Alcantara) [RHEL-138235] - smb: client: don't check for @leaf_fullpath in match_server() (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of TCP_Server_Info::refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: don't retry DFS targets on server shutdown (Paulo Alcantara) [RHEL-138235] - smb: client: fix return value of parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: optimize referral walk on failed link targets (Paulo Alcantara) [RHEL-138235] - smb: client: provide dns_resolve_{unc,name} helpers (Paulo Alcantara) [RHEL-138235] - smb: client: parse DNS domain name from domain= option (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS mount against old servers with NTLMSSP (Paulo Alcantara) [RHEL-138235] - smb: client: parse av pair type 4 in CHALLENGE_MESSAGE (Paulo Alcantara) [RHEL-138235] - smb: client: introduce av_for_each_entry() helper (Paulo Alcantara) [RHEL-138235] - smb: client: fix double free of TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-138235] {CVE-2025-21673} - smb: client: fix potential race in cifs_put_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy message when mounting shares (Paulo Alcantara) [RHEL-138235] - smb: client: don't try following DFS links in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow reconnect when sending ioctl (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of @nlsc param in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow more DFS referrals to be cached (Paulo Alcantara) [RHEL-138235] - smb: client: propagate error from cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS failover in multiuser mounts (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS interlink failover (Paulo Alcantara) [RHEL-138235] - smb: client: improve purging of cached referrals (Paulo Alcantara) [RHEL-138235] - smb: client: avoid unnecessary reconnects when refreshing referrals (Paulo Alcantara) [RHEL-138235] - smb: client: serialise cifs_construct_tcon() with cifs_mount_mutex (Paulo Alcantara) [RHEL-138235] - smb: client: handle DFS tcons in cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: refresh referral without acquiring refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: guarantee refcounted children from parent session (Paulo Alcantara) [RHEL-138235] {CVE-2024-35869} - smb: client: set correct id, uid and cruid for multiuser automounts (Paulo Alcantara) [RHEL-138235] {CVE-2024-26822} - cifs: change tcon status when need_reconnect is set on it (Paulo Alcantara) [RHEL-138235] - smb: client: fix potential NULL deref in parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: fix mount when dns_resolver key is not available (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs code dep in namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs naming in automount code (Paulo Alcantara) [RHEL-138235] - smb: client: rename cifs_dfs_ref.c to namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: ensure to try all targets when finding nested links (Paulo Alcantara) [RHEL-138235] - smb: client: introduce DFS_CACHE_TGT_LIST() (Paulo Alcantara) [RHEL-138235] - smb: client: fix null auth (Paulo Alcantara) [RHEL-138235] - smb: client: fix dfs link mount against w2k8 (Paulo Alcantara) [RHEL-138235] - cifs: fix charset issue in reconnection (Paulo Alcantara) [RHEL-138235] - smb: client: fix missed ses refcounting (Paulo Alcantara) [RHEL-138235] {CVE-2023-54076} - fs/nls: make load_nls() take a const parameter (Paulo Alcantara) [RHEL-138235] - smb: client: remove redundant pointer 'server' (Paulo Alcantara) [RHEL-138235] - smb: client: improve DFS mount check (Paulo Alcantara) [RHEL-138235] - smb: client: fix shared DFS root mounts with different prefixes (Paulo Alcantara) [RHEL-138235] - smb: client: fix parsing of source mount option (Paulo Alcantara) [RHEL-138235] - smb: client: fix warning in cifs_match_super() (Paulo Alcantara) [RHEL-138235] - cifs: fix max_credits implementation (Paulo Alcantara) [RHEL-138235] - cifs: fix sockaddr comparison in iface_cmp (Paulo Alcantara) [RHEL-138235] - cifs: fix status checks in cifs_tree_connect (Paulo Alcantara) [RHEL-138235] - cifs: fix smb1 mount regression (Paulo Alcantara) [RHEL-138235] - cifs: fix sharing of DFS connections (Paulo Alcantara) [RHEL-138235] - cifs: avoid potential races when handling multiple dfs tcons (Paulo Alcantara) [RHEL-138235] - cifs: protect access of TCP_Server_Info::{origin,leaf}_fullpath (Paulo Alcantara) [RHEL-138235] - cifs: avoid dup prefix path in dfs_get_automount_devname() (Paulo Alcantara) [RHEL-138235] - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL (Paulo Alcantara) [RHEL-138235] {CVE-2023-53246} - smb3: fix unusable share after force unmount failure (Paulo Alcantara) [RHEL-138235] - cifs: check only tcon status on tcon related functions (Paulo Alcantara) [RHEL-138235] - cifs: return DFS root session id in DebugData (Paulo Alcantara) [RHEL-138235] - cifs: fix use-after-free bug in refresh_cache_worker() (Paulo Alcantara) [RHEL-138235] {CVE-2023-53052} - cifs: set DFS root session in cifs_get_smb_ses() (Paulo Alcantara) [RHEL-138235] - cifs: remove unused function (Paulo Alcantara) [RHEL-138235] - cifs: remove duplicate code in __refresh_tcon() (Paulo Alcantara) [RHEL-138235] - cifs: remove redundant assignment to the variable match (Paulo Alcantara) [RHEL-138235] - cifs: use origin fullpath for automounts (Paulo Alcantara) [RHEL-138235] - cifs: fix source pathname comparison of dfs supers (Paulo Alcantara) [RHEL-138235] - cifs: fix confusing debug message (Paulo Alcantara) [RHEL-138235] - cifs: don't block in dfs_cache_noreq_update_tgthint() (Paulo Alcantara) [RHEL-138235] - cifs: refresh root referrals (Paulo Alcantara) [RHEL-138235] - cifs: fix refresh of cached referrals (Paulo Alcantara) [RHEL-138235] - cifs: share dfs connections and supers (Paulo Alcantara) [RHEL-138235] - cifs: split out ses and tcon retrieval from mount_get_conns() (Paulo Alcantara) [RHEL-138235] - cifs: set resolved ip in sockaddr (Paulo Alcantara) [RHEL-138235] - cifs: remove unused smb3_fs_context::mount_options (Paulo Alcantara) [RHEL-138235] - cifs: get rid of mount options string parsing (Paulo Alcantara) [RHEL-138235] - cifs: use fs_context for automounts (Paulo Alcantara) [RHEL-138235] - cifs: remove various function description warnings (Paulo Alcantara) [RHEL-138235] - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Select which microcode patch to load (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add more known models to entry sign checking (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Limit Entrysign signature checking to known generations (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use sha256() instead of init/update/final (Waiman Long) [RHEL-132479] - x86/microcode: Fix Entrysign revision check for Zen1/Naples (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Handle the case of no BIOS microcode (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add some forgotten models to the SHA check (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Load only SHA256-checksummed patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add get_patch_level() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Merge early_apply_microcode() into its single callsite (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Have __apply_microcode_amd() return bool (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Flush patch buffer mapping after application (Waiman Long) [RHEL-132479] - x86/mm: Carve out INVLPG inline asm for use by others (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Split load_microcode_amd() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Pay attention to the stepping dynamically (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix a -Wsometimes-uninitialized clang false positive (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use the family,model,stepping encoded in the patch ID (Waiman Long) [RHEL-132479] - x86/microcode/amd: Cache builtin microcode too (Waiman Long) [RHEL-132479] - x86/microcode/amd: Use correct per CPU ucode_cpu_info (Waiman Long) [RHEL-132479] - x86/microcode/amd: Remove X86_32 specific code in early_apply_microcode() & get_builtin_microcode() (Waiman Long) [RHEL-132479] - x86/microcode: Move core specific defines to local header (Waiman Long) [RHEL-132479] - x86/microcode/intel: Rename get_datasize() since its used externally (Waiman Long) [RHEL-132479] - x86/microcode: Make reload_early_microcode() static (Waiman Long) [RHEL-132479] - x86/microcode: Include vendor headers into microcode.h (Waiman Long) [RHEL-132479] - x86/microcode/intel: Move microcode functions out of cpu/intel.c (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Get rid of __find_equiv_id() (Waiman Long) [RHEL-132479] - x86/microcode: Add explicit CPU vendor dependency (Waiman Long) [RHEL-132479] - macvlan: fix possible UAF in macvlan_forward_source() (Hangbin Liu) [RHEL-144120] {CVE-2026-23001} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-131922] - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount (Jocelyn Falempe) [RHEL-148636] - audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd references (Waiman Long) [RHEL-146026] - fs: Add a pool of extra fs->pwd references to fs_struct (Waiman Long) [RHEL-146026] - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143535] {CVE-2025-71085} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930] - NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242] - pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242] - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242] - NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242] - NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242] - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242] - SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242] - NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242] - SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242] - SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242] - SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242] - SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242] - NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242] - NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419] - nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419] - pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419] - NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419] - NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419] - NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419] - NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419] - NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419] - NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419] - NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419] - NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419] - NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419] - nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419] - nfs: always check dreq->error after a commit (Mike Snitzer) [RHEL-156419] - nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419] - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231} - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942] - x86/microcode/AMD: Revert "Backport AMD microcode commits for better microcode loading support" (Waiman Long) [RHEL-155860] - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150398] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150398] - tcp: fix forever orphan socket caused by tcp_abort (Paolo Abeni) [RHEL-146187] - xfs: fix minimum agno handling for xfs alloc modes in RHEL8 (Brian Foster) [RHEL-102464] - xfs: fix uninitialized use of flags variable in xfs_alloc_vextent() (Brian Foster) [RHEL-102464] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82523] - tcp: use this_cpu_read(*X) instead of *this_cpu_ptr(X) (Davide Caratti) [RHEL-82523] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150221] - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150221] {CVE-2026-23209} - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) [RHEL-96016] - s390/kexec: Emit an error message when cmdline is too long (Mete Durlu) [RHEL-144946] - s390/boot: Fix kernel size in bootparm area (Mete Durlu) [RHEL-144946] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-137123] - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-151614] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove useless transaction in evict_linked_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-151614] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-151614] - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146419] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146419] {CVE-2025-38323} - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136288] - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136288] - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136288] - scsi: st: Tighten the page format heuristics with MODE SELECT (John Meneghini) [RHEL-136288] - scsi: st: ERASE does not change tape location (John Meneghini) [RHEL-136288] - scsi: st: Fix array overflow in st_setup() (John Meneghini) [RHEL-136288] - scsi: st: Add sysfs file position_lost_in_reset (John Meneghini) [RHEL-136288] - scsi: st: Modify st.c to use the new scsi_error counters (John Meneghini) [RHEL-136288] - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (John Meneghini) [RHEL-136288] - scsi: st: Restore some drive settings after reset (John Meneghini) [RHEL-136288] - scsi: st: Fix input/output error on empty drive reset (John Meneghini) [RHEL-136288] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930] - NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242] - pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242] - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242] - NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242] - NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242] - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242] - SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242] - NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242] - SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242] - SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242] - SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242] - SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242] - NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242] - NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419] - nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419] - pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419] - NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419] - NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419] - NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419] - NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419] - NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419] - NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419] - NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419] - NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419] - NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419] - nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419] - nfs: always check dreq->error after a commit (Mike Snitzer) [RHEL-156419] - nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419] - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231} - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942] - xfrm: esp: avoid in-place decrypt on shared skb frags - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772] - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772] - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772] - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772] - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772] - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772] - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709} - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815] - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815] - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815] - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190} - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408} - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684} - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032] - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032] - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032] - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032] - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032] - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032] - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032] - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032] - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032] - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183} - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219] - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219] - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219] - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219] - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219] - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219] - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219] - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347} - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243} - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890] - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890] - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890] - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890] - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890] - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890] - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890] - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613} - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961] - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858} - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392} - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781} - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990} - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772] - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772] - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772] - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772] - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772] - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772] - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709} - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815] - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815] - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815] - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190} - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408} - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684} - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032] - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032] - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032] - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032] - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032] - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032] - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032] - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032] - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032] - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183} - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219] - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219] - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219] - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219] - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219] - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219] - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219] - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347} - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243} - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890] - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890] - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890] - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890] - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890] - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890] - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890] - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613} - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961] - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858} - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392} - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781} - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990} - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772] - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772] - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772] - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772] - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772] - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772] - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709} - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815] - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815] - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815] - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190} - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408} - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684} - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032] - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032] - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032] - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032] - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032] - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032] - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032] - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032] - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032] - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183} - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219] - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219] - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219] - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219] - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219] - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219] - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219] - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347} - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243} - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890] - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890] - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890] - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890] - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890] - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890] - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890] - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613} - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961] - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858} - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392} - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781} - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - [rt] build kernel-rt-4.18.0-553.16.1.rt7.357.el8_10 [RHEL-44553] - x86/bhi: Fix incorrect CLEAR_BRANCH_HISTORY position in entry_INT80_compat (Waiman Long) [RHEL-50648] - [rt] build kernel-rt-4.18.0-553.15.1.rt7.356.el8_10 [RHEL-44553] - Revert "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-44613] - ionic: fix use after netif_napi_del() (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - ionic: clean interrupt before enabling queue to avoid credit race (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change (CKI Backport Bot) [RHEL-49321] {CVE-2021-47624} - xhci: Handle TD clearing for multiple streams case (CKI Backport Bot) [RHEL-47882] {CVE-2024-40927} - net: openvswitch: Fix Use-After-Free in ovs_ct_exit (cki-backport-bot) [RHEL-36362] {CVE-2024-27395} - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: fix vlan use-after-free (cki-backport-bot) [RHEL-43721] {CVE-2024-36979} - irqchip/gic-v3-its: Prevent double free on error (Charles Mirabile) [RHEL-37022] {CVE-2024-35847} - irqchip/gic-v3-its: Fix potential VPE leak on error (Charles Mirabile) [RHEL-37744] {CVE-2021-47373} - i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() (Charles Mirabile) [RHEL-34735] {CVE-2022-48632} - iommu/dma: fix zeroing of bounce buffer padding used by untrusted devices (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: remove alloc_size argument to swiotlb_tbl_map_single() (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: fix swiotlb_bounce() to do partial sync's correctly (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Reinstate page-alignment for mappings >= PAGE_SIZE (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix alignment checks when both allocation and DMA masks are present (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix double-allocation of slots due to broken alignment handling (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (cki-backport-bot) [RHEL-44441] {CVE-2024-31076} - [rt] build kernel-rt-4.18.0-553.14.1.rt7.355.el8_10 [RHEL-44553] - s390/qeth: Fix kernel panic after setting hsuid (Mete Durlu) [RHEL-49754] - perf/core: Protect event sibling list locking against interrupt inversion (Daniel Vacek) [RHEL-31798] - vt: fix unicode buffer corruption when deleting characters (Steve Best) [RHEL-36936] {CVE-2024-35823} - cifs: translate network errors on send to -ECONNABORTED (Paulo Alcantara) [RHEL-36754] - xfs: don't block in busy flushing when freeing extents (Brian Foster) [RHEL-7984] - xfs: allow extent free intents to be retried (Brian Foster) [RHEL-7984] - xfs: pass alloc flags through to xfs_extent_busy_flush() (Brian Foster) [RHEL-7984] - xfs: use deferred frees for btree block freeing (Brian Foster) [RHEL-7984] - xfs: fix bounds check in xfs_defer_agfl_block() (Brian Foster) [RHEL-7984] - xfs: validate block number being freed before adding to xefi (Brian Foster) [RHEL-7984] - xfs: rename xfs_bmap_add_free to xfs_free_extent_later (Brian Foster) [RHEL-7984] - usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (Desnes Nunes) [RHEL-36803] {CVE-2024-35790} - stm class: Fix a double free in stm_register_device() (Steve Best) [RHEL-44514] {CVE-2024-38627} - s390/qeth: Fix potential loss of L3-IP@ in case of network issues (Mete Durlu) [RHEL-49755] - tls: fix missing memory barrier in tls_init (cki-backport-bot) [RHEL-44471] {CVE-2024-36489} - xfs: fix log recovery buffer allocation for the legacy h_size fixup (Bill O'Donnell) [RHEL-46473] {CVE-2024-39472} - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: use __for_each_thread() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - exit: Use the correct exit_code in /proc/<pid>/stat (Brian Foster) [RHEL-31562] {CVE-2024-26686} - scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool (Ewan D. Milne) [RHEL-38283] {CVE-2023-52811} - scsi: qla2xxx: Fix double free of fcport (Ewan D. Milne) [RHEL-39549] {CVE-2024-26929} - scsi: qla2xxx: Fix double free of the ha->vp_map pointer (Ewan D. Milne) [RHEL-39549] {CVE-2024-26930} - scsi: qla2xxx: Fix command flush on cable pull (Ewan D. Milne) [RHEL-39549] {CVE-2024-26931} - [rt] build kernel-rt-4.18.0-553.13.1.rt7.354.el8_10 [RHEL-44553] - redhat: remove handling of deleted rhdocs/ directory from genspec.sh (Denys Vlasenko) - x86/bugs: Fix BHI retpoline check (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI handling of RRSBA (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr' (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI documentation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix return type of spectre_bhi_state() (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Make CONFIG_SPECTRE_BHI_ON the default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Mitigate KVM by default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add BHI mitigation knob (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Enumerate Branch History Injection (BHI) bug (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Define SPEC_CTRL_BHI_DIS_S (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add support for clearing branch history at syscall entry (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file (Waiman Long) [RHEL-28202] - perf/x86/amd/lbr: Use freeze based on availability (Waiman Long) [RHEL-28202] - Documentation/kernel-parameters: Add spec_rstack_overflow to mitigations=off (Waiman Long) [RHEL-28202] - KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace (Waiman Long) [RHEL-28202] - x86/bugs: Reset speculation control settings on init (Waiman Long) [RHEL-28202] - KVM: x86: Update KVM-only leaf handling to allow for 100% KVM-only leafs (Waiman Long) [RHEL-28202] - KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest (Waiman Long) [RHEL-28202] - mptcp: ensure snd_nxt is properly initialized on connect (Davide Caratti) [RHEL-39865] {CVE-2024-36889} - powerpc/pseries: Enforce hcall result buffer validity and size (Mamatha Inamdar) [RHEL-48291] {CVE-2024-40974} - wifi: mac80211: fix potential key use-after-free (Jose Ignacio Tornos Martinez) [RHEL-28007] {CVE-2023-52530} - cppc_cpufreq: Fix possible null pointer dereference (Mark Langsdorf) [RHEL-44137] {CVE-2024-38573} - net/sched: act_mirred: use the backlog for mirred ingress (Davide Caratti) [RHEL-31718] {CVE-2024-26740} - vfio/pci: Lock external INTx masking ops (Alex Williamson) [RHEL-31922] {CVE-2024-26810} - net: sched: sch_multiq: fix possible OOB write in multiq_tune() (Davide Caratti) [RHEL-43464] {CVE-2024-36978} - tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized (Guillaume Nault) [RHEL-37850] {CVE-2021-47304} - pstore/ram: Fix crash when setting number of cpus to an odd number (Lenny Szubowicz) [RHEL-29471] {CVE-2023-52619} - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node (Jocelyn Falempe) [RHEL-37101] {CVE-2023-52662} - drm/vmwgfx: Fix the lifetime of the bo cursor memory (Jocelyn Falempe) [RHEL-36962] {CVE-2024-35810} - drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed (Jocelyn Falempe) [RHEL-34987] {CVE-2024-26940} - drm/vmwgfx: Unmap the surface before resetting it on a plane state (Jocelyn Falempe) [RHEL-35217] {CVE-2023-52648} - drm/vmwgfx: Fix invalid reads in fence signaled events (Jocelyn Falempe) [RHEL-40010] {CVE-2024-36960} - block: Fix wrong offset in bio_truncate() (Ming Lei) [RHEL-43782] {CVE-2022-48747} - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CKI Backport Bot) [RHEL-46913] {CVE-2024-39487} - net: fix __dst_negative_advice() race (Xin Long) [RHEL-41183] {CVE-2024-36971} - igc: avoid returning frame twice in XDP_REDIRECT (Corinna Vinschen) [RHEL-33264] {CVE-2024-26853} - mac802154: fix llsec key resources release in mac802154_llsec_key_del (Steve Best) [RHEL-34967] {CVE-2024-26961} - cpufreq: exit() callback is optional (Mark Langsdorf) [RHEL-43840] {CVE-2024-38615} - cifs: prevent infinite recursion in CIFSGetDFSRefer() (Paulo Alcantara) [RHEL-34672] - cifs: lock chan_lock outside match_session (Paulo Alcantara) [RHEL-34672] - smb3: workaround negprot bug in some Samba servers (Paulo Alcantara) [RHEL-34672] - smb3: use netname when available on secondary channels (Paulo Alcantara) [RHEL-34672] - smb3: fix empty netname context on secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: populate empty hostnames for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: always iterate smb sessions using primary channel (Paulo Alcantara) [RHEL-34672] - cifs: Fix connections leak when tlink setup failed (Paulo Alcantara) [RHEL-34672] - cifs: Fix memory leak when build ntlmssp negotiate blob failed (Paulo Alcantara) [RHEL-34672] - cifs: always initialize struct msghdr smb_msg completely (Paulo Alcantara) [RHEL-34672] - cifs: don't send down the destination address to sendmsg for a SOCK_STREAM (Paulo Alcantara) [RHEL-34672] - cifs: revalidate mapping when doing direct writes (Paulo Alcantara) [RHEL-34672] - cifs: skip extra NULL byte in filenames (Paulo Alcantara) [RHEL-34672] - cifs: list_for_each() -> list_for_each_entry() (Paulo Alcantara) [RHEL-34672] - smb2: small refactor in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - cifs: Fix crash on unload of cifs_arc4.ko (Paulo Alcantara) [RHEL-34672] - cifs: remove check of list iterator against head past the loop body (Paulo Alcantara) [RHEL-34672] - cifs: fix reconnect on smb3 mount types (Paulo Alcantara) [RHEL-34672] - cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (Paulo Alcantara) [RHEL-34672] - cifs: skip trailing separators of prefix paths (Paulo Alcantara) [RHEL-34672] - cifs: fix ntlmssp on old servers (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL ptr dereference in refresh_mounts() (Paulo Alcantara) [RHEL-34672] - cifs: do not skip link targets when an I/O fails (Paulo Alcantara) [RHEL-34672] - cifs: fix confusing unneeded warning message on smb2.1 and earlier (Paulo Alcantara) [RHEL-34672] - smb3: fix snapshot mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix workstation_name for multiuser mounts (Paulo Alcantara) [RHEL-34672] - cifs: alloc_path_with_tree_prefix: do not append sep. if the path is empty (Paulo Alcantara) [RHEL-34672] - cifs: free ntlmsspblob allocated in negotiate (Paulo Alcantara) [RHEL-34672] - cifs: avoid use of dstaddr as key for fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: add server conn_id to fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: fix missed refcounting of ipc tcon (Paulo Alcantara) [RHEL-34672] - smb2: clarify rc initialization in smb2_reconnect (Paulo Alcantara) [RHEL-34672] - cifs: populate server_hostname for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should be set on new server (Paulo Alcantara) [RHEL-34672] - cifs: introduce cifs_ses_mark_for_reconnect() helper (Paulo Alcantara) [RHEL-34672] - cifs: protect srv_count with cifs_tcp_ses_lock (Paulo Alcantara) [RHEL-34672] - cifs: move debug print out of spinlock (Paulo Alcantara) [RHEL-34672] - cifs: do not duplicate fscache cookie for secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: connect individual channel servers to primary channel server (Paulo Alcantara) [RHEL-34672] - cifs: protect session channel fields with chan_lock (Paulo Alcantara) [RHEL-34672] - cifs: do not negotiate session if session already exists (Paulo Alcantara) [RHEL-34672] - smb3: do not setup the fscache_super_cookie until fsinfo initialized (Paulo Alcantara) [RHEL-34672] - cifs: fix potential use-after-free bugs (Paulo Alcantara) [RHEL-34672] - cifs: release lock earlier in dequeue_mid error case (Paulo Alcantara) [RHEL-34672] - smb3: remove trivial dfs compile warning (Paulo Alcantara) [RHEL-34672] - cifs: support nested dfs links over reconnect (Paulo Alcantara) [RHEL-34672] - cifs: for compound requests, use open handle if possible (Paulo Alcantara) [RHEL-34672] - cifs: split out dfs code from cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant (Paulo Alcantara) [RHEL-34672] - cifs: introduce new helper for cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: fix print of hdr_flags in dfscache_proc_show() (Paulo Alcantara) [RHEL-34672] - cifs: send workstation name during ntlmssp session setup (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should not share socket with future sessions (Paulo Alcantara) [RHEL-34672] - smb3: add dynamic trace points for socket connection (Paulo Alcantara) [RHEL-34672] - cifs: Move SMB2_Create definitions to the shared area (Paulo Alcantara) [RHEL-34672] - cifs: Move more definitions into the shared area (Paulo Alcantara) [RHEL-34672] - cifs: move NEGOTIATE_PROTOCOL definitions out into the common area (Paulo Alcantara) [RHEL-34672] - cifs: Create a new shared file holding smb2 pdu definitions (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect check for null pointer in header_assemble (Paulo Alcantara) [RHEL-34672] - smb3: correct server pointer dereferencing check to be more consistent (Paulo Alcantara) [RHEL-34672] - cifs: Deal with some warnings from W=1 (Paulo Alcantara) [RHEL-34672] - cifs: fix a sign extension bug (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect kernel doc comments (Paulo Alcantara) [RHEL-34672] - cifs: remove pathname for file from SPDX header (Paulo Alcantara) [RHEL-34672] - cifs: move SMB FSCTL definitions to common code (Paulo Alcantara) [RHEL-34672] - cifs: rename cifs_common to smbfs_common (Paulo Alcantara) [RHEL-34672] - cifs: update FSCTL definitions (Paulo Alcantara) [RHEL-34672] - cifs: cifs_md4 convert to SPDX identifier (Paulo Alcantara) [RHEL-34672] - cifs: create a MD4 module and switch cifs.ko to use it (Paulo Alcantara) [RHEL-34672] - cifs: fork arc4 and create a separate module for it for cifs and other users (Paulo Alcantara) [RHEL-34672] - smb3: fix posix extensions mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix wrong release in sess_alloc_buffer() failed path (Paulo Alcantara) [RHEL-34672] - CIFS: Fix a potencially linear read overflow (Paulo Alcantara) [RHEL-34672] - cifs: use the correct max-length for dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: create sd context must be a multiple of 8 (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp sessions of dfs connections (Paulo Alcantara) [RHEL-34672] - cifs: added WARN_ON for all the count decrements (Paulo Alcantara) [RHEL-34672] - cifs: fix missing null session check in mount (Paulo Alcantara) [RHEL-34672] - cifs: handle reconnect of tcon when there is no cached dfs referral (Paulo Alcantara) [RHEL-34672] - cifs: fix the out of range assignment to bit fields in parse_server_interfaces (Paulo Alcantara) [RHEL-34672] - smb3: fix typo in header file (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: Add support for negotiating signing algorithm (Paulo Alcantara) [RHEL-34672] - cifs: prevent NULL deref in cifs_compose_mount_options() (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL dereference in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - smbdirect: missing rc checks while waiting for rdma events (Paulo Alcantara) [RHEL-34672] - cifs: Avoid field over-reading memcpy() (Paulo Alcantara) [RHEL-34672] - smb311: remove dead code for non compounded posix query info (Paulo Alcantara) [RHEL-34672] - cifs: fix SMB1 error path in cifs_get_file_info_unix (Paulo Alcantara) [RHEL-34672] - smb3: fix uninitialized value for port in witness protocol move (Paulo Alcantara) [RHEL-34672] - cifs: fix unneeded null check (Paulo Alcantara) [RHEL-34672] - cifs: use SPDX-Licence-Identifier (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in cifs_debug.c (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in smb2misc.c (Paulo Alcantara) [RHEL-34672] - cifs: missed ref-counting smb session in find (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp servers with dfs mounts (Paulo Alcantara) [RHEL-34672] - cifs: set a minimum of 2 minutes for refreshing dfs cache (Paulo Alcantara) [RHEL-34672] - cifs: Remove unused inline function is_sysvol_or_netlogon() (Paulo Alcantara) [RHEL-34672] - cifs: remove duplicated prototype (Paulo Alcantara) [RHEL-34672] - cifs: fix ipv6 formating in cifs_ses_add_channel (Paulo Alcantara) [RHEL-34672] - cifs: fix string declarations and assignments in tracepoints (Paulo Alcantara) [RHEL-34672] - cifs: fix memory leak in smb2_copychunk_range (Paulo Alcantara) [RHEL-34672] - SMB3: incorrect file id in requests compounded with open (Paulo Alcantara) [RHEL-34672] - smb3: if max_channels set to more than one channel request multichannel (Paulo Alcantara) [RHEL-34672] - smb3: do not attempt multichannel to server which does not support it (Paulo Alcantara) [RHEL-34672] - smb3: when mounting with multichannel include it in requested capabilities (Paulo Alcantara) [RHEL-34672] - cifs: simplify SWN code with dummy funcs instead of ifdefs (Paulo Alcantara) [RHEL-34672] - cifs: log mount errors using cifs_errorf() (Paulo Alcantara) [RHEL-34672] - cifs: switch build_path_from_dentry() to using dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: fix out-of-bound memory access when calling smb3_notify() at mount point (Paulo Alcantara) [RHEL-34672] - cifs: allocate buffer in the caller of build_path_from_dentry() (Paulo Alcantara) [RHEL-34672] - cifs: make build_path_from_dentry() return const char * (Paulo Alcantara) [RHEL-34672] - cifs: remove old dead code (Paulo Alcantara) [RHEL-34672] - fs: cifs: Remove repeated struct declaration (Paulo Alcantara) [RHEL-34672] - cifs: have cifs_fattr_to_inode() refuse to change type on live inode (Paulo Alcantara) [RHEL-34672] - cifs: have ->mkdir() handle race with another client sanely (Paulo Alcantara) [RHEL-34672] - do_cifs_create(): don't set ->i_mode of something we had not created (Paulo Alcantara) [RHEL-34672] - cifs: Silently ignore unknown oplock break handle (Paulo Alcantara) [RHEL-34672] - cifs: change noisy error message to FYI (Paulo Alcantara) [RHEL-34672] - cifs: print MIDs in decimal notation (Paulo Alcantara) [RHEL-34672] - cifs: minor simplification to smb2_is_network_name_deleted (Paulo Alcantara) [RHEL-34672] - TCON Reconnect during STATUS_NETWORK_NAME_DELETED (Paulo Alcantara) [RHEL-34672] - cifs: clarify hostname vs ip address in /proc/fs/cifs/DebugData (Paulo Alcantara) [RHEL-34672] - cifs: change confusing field serverName (to ip_addr) (Paulo Alcantara) [RHEL-34672] - cifs: Reformat DebugData and index connections by conn_id. (Paulo Alcantara) [RHEL-34672] - cifs: Identify a connection by a conn_id. (Paulo Alcantara) [RHEL-34672] - smb3: negotiate current dialect (SMB3.1.1) when version 3 or greater requested (Paulo Alcantara) [RHEL-34672] - smb3: Fix out-of-bounds bug in SMB2_negotiate() (Paulo Alcantara) [RHEL-34672] - fs/cifs: Simplify bool comparison. (Paulo Alcantara) [RHEL-34672] - fs/cifs: Assign boolean values to a bool variable (Paulo Alcantara) [RHEL-34672] - cifs: Avoid error pointer dereference (Paulo Alcantara) [RHEL-34672] - cifs: Re-indent cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Unlock on errors in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Delete a stray unlock in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Tracepoints and logs for tracing credit changes. (Paulo Alcantara) [RHEL-34672] - cifs: Fix some error pointers handling detected by static checker (Paulo Alcantara) [RHEL-34672] - smb3: remind users that witness protocol is experimental (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: do not log warning message if server doesn't populate salt (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: update comments clarifying SPNEGO info in negprot response (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot rsp (Paulo Alcantara) [RHEL-34672] - SMB3: avoid confusing warning message on mount to Azure (Paulo Alcantara) [RHEL-34672] - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (Nigel Croxon) [RHEL-46662] {CVE-2024-39476} - net: fix information leakage in /proc/net/ptype (Hangbin Liu) [RHEL-44000] {CVE-2022-48757} - usb: typec: ucsi: Limit read size on v1.2 (Desnes Nunes) [RHEL-37286] {CVE-2024-35924} - minmax: relax check to allow comparison between unsigned arguments and signed constants (Desnes Nunes) [RHEL-37286] - minmax: allow comparisons of 'int' against 'unsigned char/short' (Desnes Nunes) [RHEL-37286] - minmax: allow min()/max()/clamp() if the arguments have the same signedness. (Desnes Nunes) [RHEL-37286] - minmax: add umin(a, b) and umax(a, b) (Desnes Nunes) [RHEL-37286] - minmax: fix header inclusions (Desnes Nunes) [RHEL-37286] - minmax: clamp more efficiently by avoiding extra comparison (Desnes Nunes) [RHEL-37286] - minmax: sanity check constant bounds when clamping (Desnes Nunes) [RHEL-37286] - tracing: Define the is_signed_type() macro once (Desnes Nunes) [RHEL-37286] - linux/bits.h: fix compilation error with GENMASK (Desnes Nunes) [RHEL-37286] - x86/apic: Mask IOAPIC entries when disabling the local APIC (Lenny Szubowicz) [RHEL-18077] - userfaultfd: fix a race between writeprotect and exit_mmap() (Rafael Aquini) [RHEL-38410] {CVE-2021-47461} - mm: khugepaged: skip huge page collapse for special files (Waiman Long) [RHEL-38446] {CVE-2021-47491} - cachefiles: fix memory leak in cachefiles_add_cache() (Andrey Albershteyn) [RHEL-33109] {CVE-2024-26840} - drm/amd/display: Implement bounds check for stream encoder creation in DCN301 (Michel Dänzer) [RHEL-31429] {CVE-2024-26660} - net/mlx5: Discard command completions in internal error (Kamal Heib) [RHEL-44231] {CVE-2024-38555} - drm: Don't unref the same fb many times by mistake due to deadlock handling (CKI Backport Bot) [RHEL-29011] {CVE-2023-52486} - md: fix resync softlockup when bitmap size is less than array size (Nigel Croxon) [RHEL-43942] {CVE-2024-38598} - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation (Davide Caratti) [RHEL-39712] {CVE-2024-36017} - netfilter: nf_tables: discard table flag update with pending basechain deletion (Phil Sutter) [RHEL-37205] {CVE-2024-35897} - netfilter: nf_tables: reject table flag and netdev basechain updates (Phil Sutter) [RHEL-37205] - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (Ewan D. Milne) [RHEL-40172] {CVE-2024-36924} - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (Ewan D. Milne) [RHEL-40172] {CVE-2024-36952} - netfilter: nf_tables: fix memleak in map from abort path (Phil Sutter) [RHEL-35052] {CVE-2024-27011} - netfilter: nf_tables: reject new basechain after table flag update (Phil Sutter) [RHEL-37193] {CVE-2024-35900} - netfilter: nf_tables: flush pending destroy work before exit_net release (Phil Sutter) [RHEL-37197] {CVE-2024-35899} - netfilter: complete validation of user input (Phil Sutter) [RHEL-37210] - netfilter: validate user input for expected length (Phil Sutter) [RHEL-37210] {CVE-2024-35896} - netfilter: tproxy: bail out if IP has been disabled on the device (Phil Sutter) [RHEL-44363] {CVE-2024-36270} - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (Phil Sutter) [RHEL-44532] {CVE-2024-36286} - netfilter: nf_tables: do not compare internal table flags on updates (Phil Sutter) [RHEL-35114] {CVE-2024-27065} - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (Phil Sutter) [RHEL-35028] {CVE-2024-27019} - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (Phil Sutter) [RHEL-35024] {CVE-2024-27020} - netfilter: nf_tables: __nft_expr_type_get() selects specific family type (Phil Sutter) [RHEL-35024] - netfilter: conntrack: serialize hash resizes and cleanups (Phil Sutter) [RHEL-37703] {CVE-2021-47408} - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (Phil Sutter) [RHEL-34217] {CVE-2024-26925} - netfilter: nf_tables: release batch on table validation from abort path (Phil Sutter) [RHEL-34217] - ipvlan: add ipvlan_route_v6_outbound() helper (Davide Caratti) [RHEL-38319] {CVE-2023-52796} - [rt] build kernel-rt-4.18.0-553.12.1.rt7.353.el8_10 [RHEL-44553] - net: bridge: xmit: make sure we have at least eth header len bytes (cki-backport-bot) [RHEL-44291] {CVE-2024-38538} - drivers/amd/pm: fix a use-after-free in kv_parse_power_table (Michel Dänzer) [RHEL-26893] {CVE-2023-52469} - SUNRPC: Fix a suspicious RCU usage warning (Scott Mayhew) [RHEL-30503] {CVE-2023-52623} - ice: Fix some null pointer dereference issues in ice_ptp.c (Petr Oros) [RHEL-26901] {CVE-2023-52471} - xfs: fix internal error from AGFL exhaustion (Pavel Reichl) [RHEL-45581] - sched/psi: Fix use-after-free in ep_remove_wait_queue() (Phil Auld) [RHEL-38117] {CVE-2023-52707} - wait: add wake_up_pollfree() (Phil Auld) [RHEL-38117] - net/ipv6: avoid possible UAF in ip6_route_mpath_notify() (Hangbin Liu) [RHEL-33269] {CVE-2024-26852} - net: bridge: switchdev: Skip MDB replays of deferred events on offload (Ivan Vecera) [RHEL-33117] {CVE-2024-26837} - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (Pavel Reichl) [RHEL-31700] {CVE-2024-26772} - ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() (Pavel Reichl) [RHEL-31688] {CVE-2024-26773} - ext4: fix double-free of blocks due to wrong extents moved_len (Pavel Reichl) [RHEL-31612] {CVE-2024-26704} - vxlan: Pull inner IP header in vxlan_xmit_one(). (Guillaume Nault) [RHEL-31389] - geneve: Fix incorrect inner network header offset when innerprotoinherit is set (Guillaume Nault) [RHEL-31389] - vxlan: Pull inner IP header in vxlan_rcv(). (Guillaume Nault) [RHEL-31389] - geneve: fix header validation in geneve[6]_xmit_skb (Guillaume Nault) [RHEL-31389] - geneve: make sure to pull inner header in geneve_rx() (Guillaume Nault) [RHEL-31389] - net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb (Guillaume Nault) [RHEL-31389] - net: geneve: check skb is large enough for IPv4/IPv6 header (Guillaume Nault) [RHEL-31389] - net/smc: fix neighbour and rtable leak in smc_ib_find_route() (Tobias Huschle) [RHEL-39744] {CVE-2024-36945} - igb: Fix string truncation warnings in igb_set_fw_version (Corinna Vinschen) [RHEL-38452] {CVE-2024-36010} - bonding: stop the device in bond_setup_by_slave() (Hangbin Liu) [RHEL-38327] {CVE-2023-52784} - i40e: fix vf may be used uninitialized in this function warning (Kamal Heib) [RHEL-39702] {CVE-2024-36020} - powerpc/64: Fix the definition of the fixmap area (Mamatha Inamdar) [RHEL-27191] {CVE-2021-47018} - powerpc/mm/hash64: Add a variable to track the end of IO mapping (Mamatha Inamdar) [RHEL-27191] {CVE-2021-47018} - nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). (Xin Long) [RHEL-39770] {CVE-2024-36933} - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (Xin Long) [RHEL-39770] - net: core: reject skb_copy(_expand) for fraglist GSO skbs (Xin Long) [RHEL-39779] {CVE-2024-36929} - tcp: properly terminate timers for kernel sockets (Guillaume Nault) [RHEL-37171] {CVE-2024-35910} - net: relax socket state check at accept time. (Florian Westphal) [RHEL-39831] - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (Florian Westphal) [RHEL-39831] {CVE-2024-36905} - tcp: remove redundant check on tskb (Florian Westphal) [RHEL-39831] - drm/ast: Fix soft lockup (cki-backport-bot) [RHEL-37438] {CVE-2024-35952} - null_blk: Fix return value of nullb_device_power_store() (Ming Lei) [RHEL-39341] - null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues' (Ming Lei) [RHEL-39341] - null_blk: fix return value from null_add_dev() (Ming Lei) [RHEL-39341] - [rt] build kernel-rt-4.18.0-553.11.1.rt7.352.el8_10 [RHEL-44553] - x86/bugs: Reverse instruction order of CLEAR_CPU_BUFFERS (Waiman Long) [RHEL-42121] - Revert "x86/bugs: Use fixed addressing for VERW operand" (Waiman Long) [RHEL-42121] - KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests (Waiman Long) [RHEL-42121] - x86/rfds: Mitigate Register File Data Sampling (RFDS) (Waiman Long) [RHEL-42121] - Documentation/hw-vuln: Add documentation for RFDS (Waiman Long) [RHEL-42121] - x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set (Waiman Long) [RHEL-42121] - x86/bugs: Use fixed addressing for VERW operand (Waiman Long) [RHEL-42121] - KVM/VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH (Waiman Long) [RHEL-42121] - x86/bugs: Use ALTERNATIVE() instead of mds_user_clear static key (Waiman Long) [RHEL-42121] - x86/entry_32: Add VERW just before userspace transition (Waiman Long) [RHEL-42121] - x86/entry_64: Add VERW just before userspace transition (Waiman Long) [RHEL-42121] - x86/bugs: Add asm helpers for executing VERW (Waiman Long) [RHEL-42121] - x86/cpu: Fix Gracemont uarch (Waiman Long) [RHEL-42121] - Documentation/hw-vuln: Unify filename specification in index (Waiman Long) [RHEL-42121] - KVM: VMX: Access @flags as a 32-bit value in __vmx_vcpu_run() (Waiman Long) [RHEL-42121] - x86/asm: Add _ASM_RIP() macro for x86-64 (%rip) suffix (Waiman Long) [RHEL-42121] - x86/asm: Have the __ASM_FORM macros handle commas in arguments (Waiman Long) [RHEL-42121] - x86/asm: Allow to pass macros to __ASM_FORM() (Waiman Long) [RHEL-42121] - wifi: iwlwifi: mvm: guard against invalid STA ID on removal (Jose Ignacio Tornos Martinez) [RHEL-39801] {CVE-2024-36921} - ipv6: Fix potential uninit-value access in __ip6_make_skb() (Antoine Tenart) [RHEL-39784] - ipv4: Fix uninit-value access in __ip_make_skb() (Antoine Tenart) [RHEL-39784] {CVE-2024-36927} - perf mmap: Lazily initialize zstd streams to save memory when not using it (Michael Petlan) [RHEL-34876] - perf tools: Fix spelling mistake "commpressor" -> "compressor" (Michael Petlan) [RHEL-34876] - perf record: Introduce data transferred and compressed stats (Michael Petlan) [RHEL-34876] - perf record: Introduce compressor at mmap buffer object (Michael Petlan) [RHEL-34876] - perf record: Introduce bytes written stats (Michael Petlan) [RHEL-34876] - perf record: Introduce data file at mmap buffer object (Michael Petlan) [RHEL-34876] - perf record: Start threads in the beginning of trace streaming (Alexey Bayduraev) [RHEL-34876] - perf record: Stop threads in the end of trace streaming (Michael Petlan) [RHEL-34876] - perf record: Introduce thread local variable (Michael Petlan) [RHEL-34876] - perf record: Introduce function to propagate control commands (Michael Petlan) [RHEL-34876] - perf record: Introduce thread specific data array (Michael Petlan) [RHEL-34876] - tools lib: Introduce fdarray duplicate function (Michael Petlan) [RHEL-34876] - perf record: Introduce thread affinity and mmap masks (Michael Petlan) [RHEL-34876] - gfs2: Be more careful with the quota sync generation (Andreas Gruenbacher) [RHEL-40901] - gfs2: Get rid of some unnecessary quota locking (Andreas Gruenbacher) [RHEL-40901] - gfs2: Add some missing quota locking (Andreas Gruenbacher) [RHEL-40901] - gfs2: Fold qd_fish into gfs2_quota_sync (Andreas Gruenbacher) [RHEL-40901] - gfs2: quota need_sync cleanup (Andreas Gruenbacher) [RHEL-40901] - gfs2: Fix and clean up function do_qc (Andreas Gruenbacher) [RHEL-40901] - gfs2: Revert "Add quota_change type" (Andreas Gruenbacher) [RHEL-40901] - gfs2: Revert "ignore negated quota changes" (Andreas Gruenbacher) [RHEL-40901] - gfs2: qd_check_sync cleanups (Andreas Gruenbacher) [RHEL-40901] - gfs2: Check quota consistency on mount (Andreas Gruenbacher) [RHEL-40901] - gfs2: Minor gfs2_quota_init error path cleanup (Andreas Gruenbacher) [RHEL-40901] - gfs2: fix kernel BUG in gfs2_quota_cleanup (Edward Adam Davis) [RHEL-40901] - gfs2: Clean up quota.c:print_message (Andreas Gruenbacher) [RHEL-40901] - gfs2: Clean up gfs2_alloc_parms initializers (Andreas Gruenbacher) [RHEL-40901] - gfs2: Two quota=account mode fixes (Andreas Gruenbacher) [RHEL-40901] - gfs2: Remove useless assignment (Bob Peterson) [RHEL-40901] - gfs2: simplify slot_get (Bob Peterson) [RHEL-40901] - gfs2: Simplify qd2offset (Bob Peterson) [RHEL-40901] - gfs2: Remove quota allocation info from quota file (Bob Peterson) [RHEL-40901] - gfs2: use constant for array size (Bob Peterson) [RHEL-40901] - gfs2: Set qd_sync_gen in do_sync (Bob Peterson) [RHEL-40901] - gfs2: Remove useless err set (Bob Peterson) [RHEL-40901] - gfs2: Small gfs2_quota_lock cleanup (Bob Peterson) [RHEL-40901] - gfs2: move qdsb_put and reduce redundancy (Bob Peterson) [RHEL-40901] - gfs2: Don't try to sync non-changes (Bob Peterson) [RHEL-40901] - gfs2: Simplify function need_sync (Bob Peterson) [RHEL-40901] - gfs2: remove unneeded pg_oflow variable (Bob Peterson) [RHEL-40901] - gfs2: remove unneeded variable done (Bob Peterson) [RHEL-40901] - gfs2: pass sdp to gfs2_write_buf_to_page (Bob Peterson) [RHEL-40901] - gfs2: pass sdp in to gfs2_write_disk_quota (Bob Peterson) [RHEL-40901] - gfs2: Pass sdp to gfs2_adjust_quota (Bob Peterson) [RHEL-40901] - gfs2: remove dead code for quota writes (Bob Peterson) [RHEL-40901] - gfs2: Use qd_sbd more consequently (Bob Peterson) [RHEL-40901] - gfs2: replace 'found' with dedicated list iterator variable (Jakob Koschel) [RHEL-40901] - gfs2: Some whitespace cleanups (Andreas Gruenbacher) [RHEL-40901] - gfs2: Fix gfs2_qa_get imbalance in gfs2_quota_hold (Bob Peterson) [RHEL-40901] - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg (Guillaume Nault) [RHEL-43961] {CVE-2024-38596} - af_unix: Fix data-races around sk->sk_shutdown. (Guillaume Nault) [RHEL-43961] {CVE-2024-38596} - af_unix: Fix data races around sk->sk_shutdown. (Guillaume Nault) [RHEL-43961] {CVE-2024-38596} - perf/core: Fix event sibling list locking (Daniel Vacek) [RHEL-31798] - media: bttv: fix use after free error due to btv->timeout timer (Kate Hsuan) [RHEL-38256] {CVE-2023-52847} - arp: Prevent overflow in arp_req_get(). (Antoine Tenart) [RHEL-31706] {CVE-2024-26733} - Bluetooth: btusb: Add a new PID/VID 0489/e0c8 for MT7921 (David Marlin) [RHEL-10263] - mm: swap: fix race between free_swap_and_cache() and swapoff() (Waiman Long) [RHEL-34971] {CVE-2024-26960} - swap: comments get_swap_device() with usage rule (Waiman Long) [RHEL-34971] {CVE-2024-26960} - mm/swapfile.c: __swap_entry_free() always free 1 entry (Waiman Long) [RHEL-34971] {CVE-2024-26960} - mm/swapfile.c: call free_swap_slot() in __swap_entry_free() (Waiman Long) [RHEL-34971] {CVE-2024-26960} - mm/swapfile.c: use __try_to_reclaim_swap() in free_swap_and_cache() (Waiman Long) [RHEL-34971] {CVE-2024-26960} - net: amd-xgbe: Fix skb data length underflow (Ken Cox) [RHEL-43788] {CVE-2022-48743} - ovl: fix warning in ovl_create_real() (cki-backport-bot) [RHEL-43652] {CVE-2021-47579} - net/sched: initialize noop_qdisc owner (Davide Caratti) [RHEL-35056] - net/sched: Fix mirred deadlock on device recursion (Davide Caratti) [RHEL-35056] {CVE-2024-27010} - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (Pavel Reichl) [RHEL-45029] {CVE-2024-39276} - ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() (Ken Cox) [RHEL-38713] {CVE-2021-47548} - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound (Hangbin Liu) [RHEL-44396] {CVE-2024-33621} - mlxsw: spectrum_acl_tcam: Fix stack corruption (Ivan Vecera) [RHEL-26462] {CVE-2024-26586} - inet: inet_defrag: prevent sk release while still in use (Antoine Tenart) [RHEL-33398] {CVE-2024-26921} - skb_expand_head() adjust skb->truesize incorrectly (Antoine Tenart) [RHEL-33398] - nvmet: fix ns enable/disable possible hang (Ming Lei) [RHEL-43547] - [rt] build kernel-rt-4.18.0-553.10.1.rt7.351.el8_10 [RHEL-44553] - SUNRPC: Fix RPC client cleaned up the freed pipefs dentries (Scott Mayhew) [RHEL-38264] {CVE-2023-52803} - scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() (Ewan D. Milne) [RHEL-39717] {CVE-2024-36025} - tcp: add sanity checks to rx zerocopy (Guillaume Nault) [RHEL-29494] {CVE-2024-26640} - SUNRPC: fix some memleaks in gssx_dec_option_array (Scott Mayhew) [RHEL-35209] {CVE-2024-27388} - wifi: nl80211: don't free NULL coalescing rule (Jose Ignacio Tornos Martinez) [RHEL-39752] {CVE-2024-36941} - nfs: fix UAF in direct writes (Scott Mayhew) [RHEL-34975] {CVE-2024-26958} - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 (Scott Mayhew) [RHEL-33228] {CVE-2024-26870} - drm/amd/pm: Fix error of MACO flag setting code (Michel Dänzer) [RHEL-15928] - scsi: aacraid: fix io hangs and improve performance (John Meneghini) [RHEL-23913] - block: prevent division by zero in blk_rq_stat_sum() (Ming Lei) [RHEL-37279] {CVE-2024-35925} - block: fix overflow in blk_ioctl_discard() (Ming Lei) [RHEL-39811] {CVE-2024-36917} - virtio-blk: fix implicit overflow on virtio_max_dma_size (Ming Lei) [RHEL-38131] {CVE-2023-52762} - nbd: null check for nla_nest_start (Ming Lei) [RHEL-35176] {CVE-2024-27025} - isdn: mISDN: netjet: Fix crash in nj_probe: (Ken Cox) [RHEL-38444] {CVE-2021-47284} - isdn: mISDN: Fix sleeping function called from invalid context (Ken Cox) [RHEL-38400] {CVE-2021-47468} - net/smc: avoid data corruption caused by decline (Tobias Huschle) [RHEL-38234] {CVE-2023-52775} - ubi: Check for too small LEB size in VTBL code (David Arcari) [RHEL-25092] {CVE-2024-25739} - i2c: core: Fix atomic xfer check for non-preempt config (Steve Best) [RHEL-38313] {CVE-2023-52791} - i2c: core: Run atomic i2c xfer when !preemptible (Steve Best) [RHEL-38313] {CVE-2023-52791} - firewire: ohci: mask bus reset interrupts between ISR and bottom half (Steve Best) [RHEL-39902] {CVE-2024-36950} - ipv6: init the accept_queue's spinlocks in inet6_create (Guillaume Nault) [RHEL-28899] {CVE-2024-26614} - tcp: make sure init the accept_queue's spinlocks once (Guillaume Nault) [RHEL-28899] {CVE-2024-26614} - tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (Steve Best) [RHEL-39352] {CVE-2024-36016} - mlxsw: spectrum_acl_tcam: Fix incorrect list API usage (Ivan Vecera) [RHEL-37484] {CVE-2024-36006} - pwm: Fix double shift bug (Steve Best) [RHEL-38278] {CVE-2023-52756} - mmc: sdio: fix possible resource leaks in some error paths (Steve Best) [RHEL-38149] {CVE-2023-52730} - of: unittest: Fix compile in the non-dynamic case (Steve Best) [RHEL-37070] {CVE-2023-52679} - of: unittest: Fix of_count_phandle_with_args() expected value message (Steve Best) [RHEL-37070] {CVE-2023-52679} - of: Fix double free in of_parse_phandle_with_args_map (Steve Best) [RHEL-37070] {CVE-2023-52679} - pinctrl: core: delete incorrect free in pinctrl_enable() (Steve Best) [RHEL-39756] {CVE-2024-36940} - pinctrl: core: fix possible memory leak in pinctrl_enable() (Steve Best) [RHEL-39756] {CVE-2024-36940} - media: gspca: cpia1: shift-out-of-bounds in set_flicker (Desnes Nunes) [RHEL-38331] {CVE-2023-52764} - tipc: fix a possible memleak in tipc_buf_append (Xin Long) [RHEL-39881] {CVE-2024-36954} - cifs: fix mid leak during reconnection after timeout threshold (Paulo Alcantara) [RHEL-36222] - cifs: Fix use-after-free in rdata->read_into_pages() (Paulo Alcantara) [RHEL-36222] - cifs: Fix pages leak when writedata alloc failed in cifs_write_from_iter() (Paulo Alcantara) [RHEL-36222] - cifs: Fix pages array leak when writedata alloc failed in cifs_writedata_alloc() (Paulo Alcantara) [RHEL-36222] - cifs: destage dirty pages before re-reading them for cache=none (Paulo Alcantara) [RHEL-36222] - cifs: destage any unwritten data to the server before calling copychunk_write (Paulo Alcantara) [RHEL-36222] - Adjust cifssb maximum read size (Paulo Alcantara) [RHEL-36222] - cifs: make locking consistent around the server session status (Paulo Alcantara) [RHEL-36222] - cifs: fix credit accounting for extra channel (Paulo Alcantara) [RHEL-36222] - smb3: prevent races updating CurrentMid (Paulo Alcantara) [RHEL-36222] - cifs: fix missing spinlock around update to ses->status (Paulo Alcantara) [RHEL-36222] - cifs: use echo_interval even when connection not ready. (Paulo Alcantara) [RHEL-36222] - cifs: detect dead connections only when echoes are enabled. (Paulo Alcantara) [RHEL-36222] - cifs: Fix preauth hash corruption (Paulo Alcantara) [RHEL-36222] - cifs: do not send close in compound create+close requests (Paulo Alcantara) [RHEL-36222] - cifs: ask for more credit on async read/write code paths (Paulo Alcantara) [RHEL-36222] - cifs: use discard iterator to discard unneeded network data more efficiently (Paulo Alcantara) [RHEL-36222] - cifs: Fix in error types returned for out-of-credit situations. (Paulo Alcantara) [RHEL-36222] - smb3: fix crediting for compounding when only one request in flight (Paulo Alcantara) [RHEL-36222] - cifs: New optype for session operations. (Paulo Alcantara) [RHEL-36222] - mm/gup: do not return 0 from pin_user_pages_fast() for bad args (Paulo Alcantara) [RHEL-36222] - wifi: brcmfmac: pcie: handle randbuf allocation failure (Jose Ignacio Tornos Martinez) [RHEL-44124] {CVE-2024-38575} - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). (Guillaume Nault) [RHEL-39835] {CVE-2024-36904} - wifi: mac80211: don't return unset power in ieee80211_get_tx_power() (Jose Ignacio Tornos Martinez) [RHEL-38159] {CVE-2023-52832} - wifi: ath11k: fix gtk offload status event locking (Jose Ignacio Tornos Martinez) [RHEL-38155] {CVE-2023-52777} - net: ieee802154: fix null deref in parse dev addr (Steve Best) [RHEL-38012] {CVE-2021-47257} - mm/hugetlb: fix missing hugetlb_lock for resv uncharge (Rafael Aquini) [RHEL-37465] {CVE-2024-36000} - x86/xen: Add some null pointer checking to smp.c (Vitaly Kuznetsov) [RHEL-33258] {CVE-2024-26908} - x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() (Vitaly Kuznetsov) [RHEL-33258] {CVE-2024-26908} - wifi: cfg80211: check A-MSDU format more carefully (Jose Ignacio Tornos Martinez) [RHEL-37343] {CVE-2024-35937} - wifi: rtw89: fix null pointer access when abort scan (Jose Ignacio Tornos Martinez) [RHEL-37355] {CVE-2024-35946} - atl1c: Work around the DMA RX overflow issue (Ken Cox) [RHEL-38287] {CVE-2023-52834} - wifi: ath11k: decrease MHI channel buffer length to 8KB (Jose Ignacio Tornos Martinez) [RHEL-37339] {CVE-2024-35938} - wifi: iwlwifi: mvm: rfi: fix potential response leaks (Jose Ignacio Tornos Martinez) [RHEL-37163] {CVE-2024-35912} - USB: core: Fix access violation during port device removal (Desnes Nunes) [RHEL-39853] {CVE-2024-36896} - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() (Ewan D. Milne) [RHEL-37123] {CVE-2024-35930} - netfilter: nf_tables: honor table dormant flag from netdev release event path (Phil Sutter) [RHEL-37450] {CVE-2024-36005} - wifi: iwlwifi: mvm: don't set the MFP flag for the GTK (Jose Ignacio Tornos Martinez) [RHEL-36898] {CVE-2024-27434} - wifi: iwlwifi: mvm: Fix key flags for IGTK on AP interface (Jose Ignacio Tornos Martinez) [RHEL-36898] {CVE-2024-27434} - misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspend/resume (Steve Best) [RHEL-36932] {CVE-2024-35824} - [rt] build kernel-rt-4.18.0-553.9.1.rt7.350.el8_10 [RHEL-44553] - x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (Steve Best) [RHEL-37262] {CVE-2024-35876} - net/sched: flower: Fix chain template offload (Xin Long) [RHEL-31313] {CVE-2024-26669} - SUNRPC: fix a memleak in gss_import_v2_context (Scott Mayhew) [RHEL-35195] {CVE-2023-52653} - efivarfs: force RO when remounting if SetVariable is not supported (Pavel Reichl) [RHEL-26564] {CVE-2023-52463} - dmaengine: idxd: add a write() method for applications to submit work (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823} - dmaengine: idxd: add a new security check to deal with a hardware erratum (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823} - VFIO: Add the SPR_DSA and SPR_IAX devices to the denylist (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823} - quota: Fix potential NULL pointer dereference (Pavel Reichl) [RHEL-33219] {CVE-2024-26878} - locking/lockdep: Fix overflow in presentation of average lock-time (Čestmír Kalina) [RHEL-17678] - blk-cgroup: Properly propagate the iostat update up the hierarchy (Ming Lei) [RHEL-40939] - proc: Use new_inode not new_inode_pseudo (Ian Kent) [RHEL-40167] - stmmac: Clear variable when destroying workqueue (Izabela Bakollari) [RHEL-31822] {CVE-2024-26802} - powerpc/pseries/memhp: Fix access beyond end of drmem array (Mamatha Inamdar) [RHEL-26495] {CVE-2023-52451} - platform/x86: wmi: Fix opening of char device (David Arcari) [RHEL-38258] {CVE-2023-52864} - Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" (Kamal Heib) [RHEL-36908] {CVE-2023-52658} - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed (Cathy Avery) [RHEL-39074] - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove (Cathy Avery) [RHEL-39074] - hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes (Cathy Avery) [RHEL-39074] - hv_netvsc: remove duplicated including of slab.h (Cathy Avery) [RHEL-39074] - hv_netvsc: rndis_filter needs to select NLS (Cathy Avery) [RHEL-39074] - hv_netvsc: Mark VF as slave before exposing it to user-mode (Cathy Avery) [RHEL-39074] - hv_netvsc: Fix race of register_netdevice_notifier and VF register (Cathy Avery) [RHEL-39074] - hv_netvsc: fix race of netvsc and VF register_netdevice (Cathy Avery) [RHEL-39074] - hv_netvsc: fix netvsc_send_completion to avoid multiple message length checks (Cathy Avery) [RHEL-39074] - hv_netvsc: Allocate rx indirection table size dynamically (Cathy Avery) [RHEL-39074] - net: hv_netvsc: Fix a warning triggered by memcpy in rndis_filter (Cathy Avery) [RHEL-39074] - gfs2: Fix lru_count accounting (Andreas Gruenbacher) [RHEL-32941] - gfs2: Fix "Make glock lru list scanning safer" (Andreas Gruenbacher) [RHEL-32941] - gfs2: Fix "ignore unlock failures after withdraw" (Andreas Gruenbacher) [RHEL-32941] - gfs2: Don't set GLF_LOCK in gfs2_dispose_glock_lru (Andreas Gruenbacher) [RHEL-32941] - gfs2: Don't forget to complete delayed withdraw (Andreas Gruenbacher) [RHEL-32941] - gfs2: Delay withdraw from atomic context (Andreas Gruenbacher) [RHEL-32941] - gfs2: trivial clean up of gfs2_ail_error (Andreas Gruenbacher) [RHEL-32941] - ext4: fix corruption during on-line resize (Carlos Maiolino) [RHEL-36974] {CVE-2024-35807} - ext4: correct offset of gdb backup in non meta_bg group to update_backups (Carlos Maiolino) [RHEL-36974] - ext4: avoid online resizing failures due to oversized flex bg (Carlos Maiolino) [RHEL-30507] {CVE-2023-52622} - ext4: use time_is_before_jiffies() instead of open coding it (Carlos Maiolino) [RHEL-30507] - ext4: unify the type of flexbg_size to unsigned int (Carlos Maiolino) [RHEL-30507] - ext4: remove unnecessary check from alloc_flex_gd() (Carlos Maiolino) [RHEL-30507] - tracing: Do no increment trace_clock_global() by one (Jerome Marchand) [RHEL-27107] {CVE-2021-46939} - tracing: Restructure trace_clock_global() to never block (Jerome Marchand) [RHEL-27107] {CVE-2021-46939} - net/sched: act_skbmod: prevent kernel-infoleak (Xin Long) [RHEL-37220] {CVE-2024-35893} - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (Xin Long) [RHEL-38307] {CVE-2023-52845} - redhat: remove the merge subtrees script (Derek Barbosa) - redhat: rhdocs: delete .get_maintainer.conf (Derek Barbosa) - redhat: rhdocs: Remove the rhdocs directory (Derek Barbosa) - dyndbg: fix old BUG_ON in >control parser (Waiman Long) [RHEL-37111] {CVE-2024-35947} - dyndbg: let query-modname override actual module name (Waiman Long) [RHEL-37111] - dyndbg: make dyndbg a known cli param (Waiman Long) [RHEL-37111] - lan78xx: Fix exception on link speed change (Jamie Bainbridge) [RHEL-33437] - net: usb: lan78xx: don't modify phy_device state concurrently (Jamie Bainbridge) [RHEL-33437] - efi: runtime: Fix potential overflow of soft-reserved region size (Lenny Szubowicz) [RHEL-33096] {CVE-2024-26843} - perf/arm-cmn: Fail DTC counter allocation correctly (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Rework DTC counters (again) (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Fix DTC domain detection (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Revamp model detection (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Fix port detection for CMN-700 (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Move overlapping wp_combine field (Michael Petlan) [RHEL-23841] - Partially revert "perf/arm-cmn: Optimise DTC counter accesses" (Michael Petlan) [RHEL-23841] - drivers/perf: Compile with gnu99 standard (Michael Petlan) [RHEL-23841] - x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (Steve Best) [RHEL-36994] {CVE-2024-35801} - watchdog: softdog: Add options 'soft_reboot_cmd' and 'soft_active_on_boot' (Waiman Long) [RHEL-19723] - tipc: fix UAF in error path (Xin Long) [RHEL-34278] {CVE-2024-36886} - [rt] build kernel-rt-4.18.0-553.8.1.rt7.349.el8_10 [RHEL-40882] - udf: Fix NULL pointer dereference in udf_symlink function (Pavel Reichl) [RHEL-37769] {CVE-2021-47353} - net: ti: fix UAF in tlan_remove_one (Jose Ignacio Tornos Martinez) [RHEL-38940] {CVE-2021-47310} - ARM: footbridge: fix PCI interrupt mapping (Myron Stowe) [RHEL-26971] {CVE-2021-46909} - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (Kamal Heib) [RHEL-37454] {CVE-2024-36004} - net/mlx5e: Fix mlx5e_priv_init() cleanup flow (Kamal Heib) [RHEL-37424] {CVE-2024-35959} - net/mlx5: Properly link new fs rules into the tree (Kamal Heib) [RHEL-37420] {CVE-2024-35960} - net/mlx5e: fix a potential double-free in fs_any_create_groups (Kamal Heib) [RHEL-37091] {CVE-2023-52667} - net: ena: Fix incorrect descriptor free behavior (Kamal Heib) [RHEL-37428] {CVE-2024-35958} - mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - mISDN: fix possible use-after-free in HFC_cleanup() (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - implement dh fallback for primes > 4K (Vladis Dronov) [RHEL-35106] - crypto: qat - avoid division by zero (Vladis Dronov) [RHEL-35106] - crypto: qat - resolve race condition during AER recovery (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - use kcalloc_node() instead of kzalloc_node() (Vladis Dronov) [RHEL-35106] - [rt] Enable CONFIG_DRM_MGAG200_DISABLE_WRITECOMBINE (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Add an option to disable Write-Combine (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Fix caching setup for remapped video memory (Jocelyn Falempe) [RHEL-36172] - Revert "drm/mgag200: Add a workaround for low-latency" (Jocelyn Falempe) [RHEL-36172] - mptcp: fix data re-injection from stale subflow (Davide Caratti) [RHEL-33133] {CVE-2024-26826} - ipv6: sr: fix incorrect unregister order (Hangbin Liu) [RHEL-31730] - ipv6: sr: fix possible use-after-free and null-ptr-deref (Hangbin Liu) [RHEL-31730] {CVE-2024-26735} - net/bnx2x: Prevent access to a freed page in page_pool (Michal Schmidt) [RHEL-14195 RHEL-33243] {CVE-2024-26859} - bnx2x: new flag for track HW resource allocation (Michal Schmidt) [RHEL-14195 RHEL-33243] - bnx2x: fix page fault following EEH recovery (Michal Schmidt) [RHEL-14195 RHEL-33243] - x86: KVM: SVM: always update the x2avic msr interception (Maxim Levitsky) [RHEL-15495] {CVE-2023-5090} - EDAC/thunderx: Fix possible out-of-bounds string access (Aristeu Rozanski) [RHEL-26573] {CVE-2023-52464} - [rt] build kernel-rt-4.18.0-553.7.1.rt7.348.el8_10 [RHEL-34640] - net: qcom/emac: fix UAF in emac_remove (Ken Cox) [RHEL-37834] {CVE-2021-47311} - perf/core: Bail out early if the request AUX area is out of bound (Michael Petlan) [RHEL-38268] {CVE-2023-52835} - crypto: pcrypt - Fix hungtask for PADATA_RESET (Herbert Xu) [RHEL-38171] {CVE-2023-52813} - drm/amdgpu: fix use-after-free bug (Jocelyn Falempe) [RHEL-31240] {CVE-2024-26656} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash (Ivan Vecera) [RHEL-37008] {CVE-2024-35854} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update (Ivan Vecera) [RHEL-37004] {CVE-2024-35855} - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (Ivan Vecera) [RHEL-37012] {CVE-2024-35853} - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work (Ivan Vecera) [RHEL-37016] {CVE-2024-35852} - mlxsw: spectrum_acl_tcam: Fix warning during rehash (Ivan Vecera) [RHEL-37480] {CVE-2024-36007} - can: peak_pci: peak_pci_remove(): fix UAF (Jose Ignacio Tornos Martinez) [RHEL-38419] {CVE-2021-47456} - usbnet: fix error return code in usbnet_probe() (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - usbnet: sanity check for maxpacket (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - net/mlx5e: fix a double-free in arfs_create_groups (Kamal Heib) [RHEL-36920] {CVE-2024-35835} - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds (Jose Ignacio Tornos Martinez) [RHEL-38220] {CVE-2023-52878} - net: cdc_eem: fix tx fixup skb leak (Jose Ignacio Tornos Martinez) [RHEL-38080] {CVE-2021-47236} - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Jose Ignacio Tornos Martinez) [RHEL-38113] {CVE-2023-52703} - usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() (Desnes Nunes) [RHEL-38248] {CVE-2023-52877} - usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (Desnes Nunes) [RHEL-38240] {CVE-2023-52781} - gro: fix ownership transfer (Xin Long) [RHEL-37226] {CVE-2024-35890} - tipc: fix kernel warning when sending SYN message (Xin Long) [RHEL-38109] {CVE-2023-52700} - erspan: make sure erspan_base_hdr is present in skb->head (Xin Long) [RHEL-37230] {CVE-2024-35888} - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() (Bryan Gurney) [RHEL-17366] - scsi: mpi3mr: Sanitise num_phys (Bryan Gurney) [RHEL-17366] - netfilter: nf_tables: use timestamp to check for set element timeout (Phil Sutter) [RHEL-38023] {CVE-2024-27397} - net/ipv6: SKB symmetric hash should incorporate transport ports (Sabrina Dubroca) [RHEL-32061] - crypto: s390/aes - Fix buffer overread in CTR mode (Herbert Xu) [RHEL-37089] {CVE-2023-52669} - net: Save and restore msg_namelen in sock_sendmsg (Jamie Bainbridge) [RHEL-35893] - net: prevent address rewrite in kernel_bind() (Jamie Bainbridge) [RHEL-35893] - net: prevent rewrite of msg_name in sock_sendmsg() (Jamie Bainbridge) [RHEL-35893] - net: replace calls to sock->ops->connect() with kernel_connect() (Jamie Bainbridge) [RHEL-35893] - net: Avoid address overwrite in kernel_connect (Jamie Bainbridge) [RHEL-35893] - wifi: iwlwifi: dbg-tlv: ensure NUL termination (Jose Ignacio Tornos Martinez) [RHEL-37026] {CVE-2024-35845} - wifi: mac80211: fix potential sta-link leak (Jose Ignacio Tornos Martinez) [RHEL-36916] {CVE-2024-35838} - wifi: nl80211: reject iftype change with mesh ID change (Jose Ignacio Tornos Martinez) [RHEL-36884] {CVE-2024-27410} - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (Jose Ignacio Tornos Martinez) [RHEL-36807] {CVE-2024-35789} - Bluetooth: Avoid potential use-after-free in hci_error_reset (David Marlin) [RHEL-31826] {CVE-2024-26801} - tls: disable async encrypt/decrypt (Sabrina Dubroca) [RHEL-26362 RHEL-26409 RHEL-26420] {CVE-2024-26585 CVE-2024-26583 CVE-2024-26584} - Squashfs: check the inode number is not the invalid value of zero (Phillip Lougher) [RHEL-35096] {CVE-2024-26982} - ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/msg.c: update and document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/sem.c: document and update memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: update/document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: remove duplicated code (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (Kamal Heib) [RHEL-30582] {CVE-2023-52626} - Revert "ACPI: bus: Rework system-level device notification handling" (Prarit Bhargava) [RHEL-21486] - hwrng: core - Fix page fault dead lock on mmap-ed hwrng (Prarit Bhargava) [RHEL-29485] {CVE-2023-52615} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - powerpc/pseries: pci - logic bug (Mamatha Inamdar) [RHEL-240146] - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228} - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899] {CVE-2026-90036} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680] {CVE-2026-72262} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641} - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781] {CVE-2026-74583} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916] {CVE-2026-68377} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271288] {CVE-2026-89631} - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280060] {CVE-2026-98320} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271853] {CVE-2026-93817} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191034] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191034] {CVE-2026-53196} - gfs2: a minor finish_xmote cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor run_queue fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: only apply DLM_LKF_VALBLK if sb_lvbptr is not NULL (Alexander Aring) [RHEL-129363] - gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Use wait_event_freezable_timeout() for freezable kthread (Andreas Gruenbacher) [RHEL-129363] - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-129363] - gfs2: low-memory forced flush fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: add missing withdraw locking (Andreas Gruenbacher) [RHEL-129363] - gfs2: Disable GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename "gfs_recovery" workqueue to "gfs2_recovery" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-129363] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-129363] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify do_promote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-129363] - gfs2: introduce new gfs2_glock_assert_withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify refcounting in do_xmote (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Make recovery error more readable (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark the remaining process-independent glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark flock glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of newlines in log messages (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-129363] - gfs2: Sanitize kthread stopping (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix logd wakeup on I/O error (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_quotad (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_logd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove duplicate check in do_xmote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove space before newline (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix LM_FLAG_TRY* logic in add_to_queue (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove DLM_LKF_ALTCW / DLM_LKF_ALTPR code (Andreas Gruenbacher) [RHEL-129363] - gfs2: Further sanitize lock_dlm.c (Andreas Gruenbacher) [RHEL-129363] - gfs2: sanitize the gdlm_ast -> finish_xmote interface (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify DLM_LKF_QUECVT use (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-129363] - gfs2: Lift withdraw check out of gfs2_ail1_empty (Andreas Gruenbacher) [RHEL-129363] - gfs2: don't withdraw if init_threads() got interrupted (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-129363] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix slab-use-after-free in gfs2_qd_dealloc (Andreas Gruenbacher) [RHEL-129363] {CVE-2023-52760} - gfs2: Fix asynchronous thread destruction (Andreas Gruenbacher) [RHEL-129363] - gfs2: Stop using gfs2_make_fs_ro for withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-129363] - gfs2: Turn gfs2_withdraw into a void function (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark withdraws as unlikely (Andreas Gruenbacher) [RHEL-129363] - gfs2: ignore rindex_update failure in dinode_dealloc (Andreas Gruenbacher) [RHEL-129363] - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270732] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256684] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256684] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256684] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271657] {CVE-2026-93288} - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254282] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-263292] {CVE-2026-89479} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254357] {CVE-2026-74588} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222954] {CVE-2026-52935} - powerpc/pseries: pci - logic bug (Mamatha Inamdar) [RHEL-240146] - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228} - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899] {CVE-2026-90036} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680] {CVE-2026-72262} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641} - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781] {CVE-2026-74583} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916] {CVE-2026-68377} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270905] {CVE-2026-89777} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263644] {CVE-2026-68202} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254200] {CVE-2026-80590} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233134] {CVE-2026-64572} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225459] {CVE-2026-64114} - xfs: bounds-check buffer log item's dirty bitmap (CKI Backport Bot) [RHEL-253365] {CVE-2026-80536} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234242] {CVE-2026-64266} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271288] {CVE-2026-89631} - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280060] {CVE-2026-98320} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271853] {CVE-2026-93817} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191034] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191034] {CVE-2026-53196} - gfs2: a minor finish_xmote cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor run_queue fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: only apply DLM_LKF_VALBLK if sb_lvbptr is not NULL (Alexander Aring) [RHEL-129363] - gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Use wait_event_freezable_timeout() for freezable kthread (Andreas Gruenbacher) [RHEL-129363] - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-129363] - gfs2: low-memory forced flush fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: add missing withdraw locking (Andreas Gruenbacher) [RHEL-129363] - gfs2: Disable GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename "gfs_recovery" workqueue to "gfs2_recovery" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-129363] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-129363] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify do_promote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-129363] - gfs2: introduce new gfs2_glock_assert_withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify refcounting in do_xmote (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Make recovery error more readable (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark the remaining process-independent glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark flock glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of newlines in log messages (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-129363] - gfs2: Sanitize kthread stopping (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix logd wakeup on I/O error (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_quotad (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_logd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove duplicate check in do_xmote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove space before newline (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix LM_FLAG_TRY* logic in add_to_queue (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove DLM_LKF_ALTCW / DLM_LKF_ALTPR code (Andreas Gruenbacher) [RHEL-129363] - gfs2: Further sanitize lock_dlm.c (Andreas Gruenbacher) [RHEL-129363] - gfs2: sanitize the gdlm_ast -> finish_xmote interface (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify DLM_LKF_QUECVT use (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-129363] - gfs2: Lift withdraw check out of gfs2_ail1_empty (Andreas Gruenbacher) [RHEL-129363] - gfs2: don't withdraw if init_threads() got interrupted (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-129363] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix slab-use-after-free in gfs2_qd_dealloc (Andreas Gruenbacher) [RHEL-129363] {CVE-2023-52760} - gfs2: Fix asynchronous thread destruction (Andreas Gruenbacher) [RHEL-129363] - gfs2: Stop using gfs2_make_fs_ro for withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-129363] - gfs2: Turn gfs2_withdraw into a void function (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark withdraws as unlikely (Andreas Gruenbacher) [RHEL-129363] - gfs2: ignore rindex_update failure in dinode_dealloc (Andreas Gruenbacher) [RHEL-129363] - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270732] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256684] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256684] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256684] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271657] {CVE-2026-93288} - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254282] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-263292] {CVE-2026-89479} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254357] {CVE-2026-74588} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222954] {CVE-2026-52935} - powerpc/pseries: pci - logic bug (Mamatha Inamdar) [RHEL-240146] - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228} - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899] {CVE-2026-90036} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680] {CVE-2026-72262} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641} - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781] {CVE-2026-74583} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916] {CVE-2026-68377} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - [rt] build kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 [RHEL-53529] - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071} - [rt] build kernel-rt-4.18.0-553.21.1.rt7.362.el8_10 [RHEL-53529] - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874] - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558} - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441} - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904} - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322} - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246} - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008} - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228} - [rt] build kernel-rt-4.18.0-553.20.1.rt7.361.el8_10 [RHEL-53529] - KVM: arm64: Disassociate vcpus from redistributor region on teardown (Shaoqin Huang) [RHEL-48417] {CVE-2024-40989} - devres: Fix memory leakage caused by driver API devm_free_percpu() (CKI Backport Bot) [RHEL-55597] {CVE-2024-43871} - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (Izabela Bakollari) [RHEL-26680] {CVE-2024-26600} - nvmet-fc: avoid deadlock on delete association path (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - nvmet-fc: release reference on target port (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - ACPI: LPIT: Avoid u32 multiplication overflow (Mark Langsdorf) [RHEL-37062] {CVE-2023-52683} - sched/deadline: Fix task_struct reference leak (Phil Auld) [RHEL-50904] {CVE-2024-41023} - nfsd: fix crash on LOCKT on reexported NFSv3 (Benjamin Coddington) [RHEL-31515] - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path (CKI Backport Bot) [RHEL-26570] {CVE-2024-26595} - mlxsw: spectrum_acl_tcam: Move devlink param to TCAM code (Ivan Vecera) [RHEL-26570] {CVE-2024-26595} - ACPI: extlog: fix NULL pointer dereference check (Mark Langsdorf) [RHEL-29110] {CVE-2023-52605} - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() (Mark Langsdorf) [RHEL-33198] {CVE-2024-26894} - mm: prevent derefencing NULL ptr in pfn_section_valid() (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - mm, kmsan: fix infinite recursion due to RCU critical section (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - cipso: make cipso_v4_skbuff_delattr() fully remove the CIPSO options (Ondrej Mosnacek) [RHEL-30904] - cipso: fix total option length computation (Ondrej Mosnacek) [RHEL-30904] - ext4: do not create EA inode under buffer lock (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: check the return value of ext4_xattr_inode_dec_ref() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (Carlos Maiolino) [RHEL-48507] {CVE-2024-40998} - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - [rt] build kernel-rt-4.18.0-553.19.1.rt7.360.el8_10 [RHEL-53529] - drm/i915/vma: Fix UAF on destroy against retire race (Mika Penttilä) [RHEL-35222] {CVE-2024-26939} - RHEL-48620 (Kenneth Yin) [RHEL-48620] - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (CKI Backport Bot) [RHEL-42721] {CVE-2024-26855} - net: usb: asix: do not force pause frames support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix "can't send until first packet is send" issue (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix modprobe "sysfs: cannot create duplicate filename" (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: add proper error handling of usb read errors (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix wrong return value in asix_check_host_enable() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix uninit-value in asix_mdio_read() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: fix boolconv.cocci warnings (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: do not call phy_disconnect() for ax88178 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: move embedded PHY detection as early as possible (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix uninit value bugs (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add missing stop (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: suspend PHY on driver probe (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: manage PHY PM from MAC (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: add error handling for asix_mdio_* functions (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add phylib support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: refactor asix_read_phy_addr() and handle errors on return (Ken Cox) [RHEL-28108] {CVE-2021-47101} - SUNRPC: always free ctxt when freeing deferred request (Jay Shin) [RHEL-40936] - SUNRPC: double free xprt_ctxt while still in use (Jay Shin) [RHEL-40936] - SUNRPC: Remove svc_rqst::rq_xprt_hlen (Jay Shin) [RHEL-40936] - SUNRPC: Remove dead code in svc_tcp_release_rqst() (Jay Shin) [RHEL-40936] - x86/bugs: Extend VMware Retbleed workaround to Nehalem & earlier CPUs (Waiman Long) [RHEL-48646] - wifi: iwlwifi: read txq->read_ptr under lock (Jose Ignacio Tornos Martinez) [RHEL-39797] {CVE-2024-36922} - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (John Meneghini) [RHEL-39908] {CVE-2024-36919} - nbd: always initialize struct msghdr completely (Ming Lei) [RHEL-29498] {CVE-2024-26638} - block: don't call rq_qos_ops->done_bio if the bio isn't tracked (Ming Lei) [RHEL-42151] {CVE-2021-47412} - nvmet: fix a possible leak when destroy a ctrl during qp establishment (Maurizio Lombardi) [RHEL-52013] {CVE-2024-42152} - ipv6: prevent NULL dereference in ip6_output() (Sabrina Dubroca) [RHEL-39912] {CVE-2024-36901} - ppp: reject claimed-as-LCP but actually malformed packets (Guillaume Nault) [RHEL-51052] {CVE-2024-41044} - leds: trigger: Unregister sysfs attributes before calling deactivate() (CKI Backport Bot) [RHEL-54834] {CVE-2024-43830} - crypto: bcm - Fix pointer arithmetic (cki-backport-bot) [RHEL-44108] {CVE-2024-38579} - scsi: qedf: Ensure the copied buf is NUL terminated (John Meneghini) [RHEL-44195] {CVE-2024-38559} - x86/bhi: Avoid warning in #DB handler due to BHI mitigation (Waiman Long) [RHEL-53657] {CVE-2024-42240} - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (CKI Backport Bot) [RHEL-47529] {CVE-2024-40901} - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (CKI Backport Bot) [RHEL-39843] {CVE-2024-36902} - net: usb: ax88179_178a: improve link status logs (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: improve reset check (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: fix link status when link is set to down/up (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: avoid writing the mac address before first reading (Jose Ignacio Tornos Martinez) [RHEL-45167] - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - media: cec: cec-api: add locking in cec_release() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid confusing "transmit timed out" message (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid recursive cec_claim_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: remove length check of Timer Status (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: count low-drive, error and arb-lost conditions (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add note about *_from_edid() function usage in drm (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_unconfigured() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_nb_transmit_canceled() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: don't set last_initiator if tx in progress (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: disable adapter in cec_devnode_unregister (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: not all messages were passed on when monitoring (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add support for Absolute Volume Control (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: log when claiming LA fails unexpectedly (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: drop activate_cnt, use state info instead (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: reconfigure if the PA changes during configuration (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: fix is_configuring state (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: stop trying LAs on CEC_TX_STATUS_TIMEOUT (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't unconfigure if already unconfigured (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add optional adap_configured callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add xfer_timeout_ms field (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: use call_op and check for !unregistered (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix interrupt en/disable handling (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: drop unused 'enabled' field from struct cec_pin (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix off-by-one SFT check (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: rename timer overrun variables (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: correctly pass on reply results (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: abort if the current transmit was canceled (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: call enable_adap on s_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: media/cec.h: document cec_adapter fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix a deadlock situation (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: safely unhook lists in cec_data (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: copy sequence field for the reply (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix trivial style warnings (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: add 'unregistered' checks (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't use flush_scheduled_work() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: Use fallthrough pseudo-keyword (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: remove unused waitq and phys_addrs fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: silence shift wrapping warning in __cec_s_log_addrs() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: move the core to a separate directory (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - net/iucv: Avoid explicit cpumask var allocation on stack (CKI Backport Bot) [RHEL-51631] {CVE-2024-42094} - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (Dick Kennedy) [RHEL-40400] - KVM: selftests: Make hyperv_clock require TSC based system clocksource (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Run clocksource dependent tests with hyperv_clocksource_tsc_page too (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Use generic sys_clocksource_is_tsc() in vmx_nested_tsc_scaling_test (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Generalize check_clocksource() from kvm_clock_test (Vitaly Kuznetsov) [RHEL-19027] - firmware: cs_dsp: Return error if block header overflows file (CKI Backport Bot) [RHEL-53646] {CVE-2024-42238} - firmware: cs_dsp: Validate payload length before processing block (CKI Backport Bot) [RHEL-53638] {CVE-2024-42237} - mm, slub: fix potential memoryleak in kmem_cache_open() (Waiman Long) [RHEL-38404] {CVE-2021-47466} - slub: don't panic for memcg kmem cache creation failure (Waiman Long) [RHEL-38404] {CVE-2021-47466} - wifi: ath11k: fix htt pktlog locking (Jose Ignacio Tornos Martinez) [RHEL-38317] {CVE-2023-52800} - wifi: ath11k: fix dfs radar event locking (Jose Ignacio Tornos Martinez) [RHEL-38165] {CVE-2023-52798} - lib/generic-radix-tree.c: Don't overflow in peek() (Waiman Long) [RHEL-37737] {CVE-2021-47432} - include/linux/generic-radix-tree.h: replace kernel.h with the necessary inclusions (Waiman Long) [RHEL-37737] {CVE-2021-47432} - EDAC/i10nm: Skip the absent memory controllers (Aristeu Rozanski) [RHEL-43236] - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (John Meneghini) [RHEL-38197] {CVE-2023-52809} - gfs2: Fix potential glock use-after-free on unmount (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: simplify gdlm_put_lock with out_free label (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: Remove ill-placed consistency check (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - nvme-fc: do not wait in vain when unloading module (Ewan D. Milne) [RHEL-33083] {CVE-2024-26846} - HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts (CKI Backport Bot) [RHEL-49698] {CVE-2022-48866} - scsi: qedf: Set qed_slowpath_params to zero before use (John Meneghini) [RHEL-9797] - scsi: qedf: Wait for stag work during unload (John Meneghini) [RHEL-9797] - scsi: qedf: Don't process stag work during unload and recovery (John Meneghini) [RHEL-9797] - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - mm: avoid overflows in dirty throttling logic (Audra Mitchell) [RHEL-51840] {CVE-2024-42131} - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - ACPI: fix NULL pointer dereference (Mark Langsdorf) [RHEL-37897] {CVE-2021-47289} - [rt] build kernel-rt-4.18.0-553.18.1.rt7.359.el8_10 [RHEL-53529] - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING (Ewan D. Milne) [RHEL-39805] {CVE-2024-36920} - tun: limit printing rate when illegal packet received by tun dev (Jon Maloy) [RHEL-35046] {CVE-2024-27013} - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu/mes: fix use-after-free issue (Michel Dänzer) [RHEL-44043] {CVE-2024-38581} - drm/amdgpu: Fix the null pointer when load rlc firmware (Michel Dänzer) [RHEL-30603] {CVE-2024-26649} - drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (Michel Dänzer) [RHEL-35160] {CVE-2024-27042} - net/sched: Fix UAF when resolving a clash (Xin Long) [RHEL-51014] {CVE-2024-41040} - tcp_metrics: validate source addr length (Guillaume Nault) [RHEL-52025] {CVE-2024-42154} - NFSv4/pnfs: Fix a use-after-free bug in open (Benjamin Coddington) [RHEL-35508] - NFSv4: Don't hold the layoutget locks across multiple RPC calls (Benjamin Coddington) [RHEL-35508] - scsi: qedf: Make qedf_execute_tmf() non-preemptible (John Meneghini) [RHEL-51799] {CVE-2024-42124} - Input: elantech - fix stack out of bound access in elantech_change_report_id() (CKI Backport Bot) [RHEL-41938] {CVE-2021-47097} - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (CKI Backport Bot) [RHEL-28982] {CVE-2023-52478} - drm/radeon: fix UBSAN warning in kv_dpm.c (CKI Backport Bot) [RHEL-48399] {CVE-2024-40988} - usb: core: Don't hold the device lock while sleeping in do_proc_control() (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - USB: core: Make do_proc_control() and do_proc_bulk() killable (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - scsi: qedi: Fix crash while reading debugfs attribute (CKI Backport Bot) [RHEL-48327] {CVE-2024-40978} - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CKI Backport Bot) [RHEL-48309] {CVE-2024-40977} - net: tcp: accept old ack during closing (Jamie Bainbridge) [RHEL-52433] - wifi: iwlwifi: mvm: don't read past the mfuart notifcation (CKI Backport Bot) [RHEL-48016] {CVE-2024-40941} - net/iucv: fix use after free in iucv_sock_close() (Mete Durlu) [RHEL-53988] - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (CKI Backport Bot) [RHEL-47908] {CVE-2024-40929} - Input: aiptek - properly check endpoint type (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - use descriptors of current altsetting (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - fix endpoint sanity check (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB (CKI Backport Bot) [RHEL-52373] {CVE-2024-42226} - wifi: mt76: replace skb_put with skb_put_zero (CKI Backport Bot) [RHEL-52366] {CVE-2024-42225} - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (CKI Backport Bot) [RHEL-47776] {CVE-2024-40912} - wifi: cfg80211: Lock wiphy in cfg80211_get_station (CKI Backport Bot) [RHEL-47758] {CVE-2024-40911} - VMCI: Use struct_size() in kmalloc() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() (Steve Best) [RHEL-37325] {CVE-2024-35944} - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values (Jose Ignacio Tornos Martinez) [RHEL-51761] {CVE-2024-42114} - usb: atm: cxacru: fix endpoint checking in cxacru_bind() (CKI Backport Bot) [RHEL-51442] {CVE-2024-41097} - nfs: handle error of rpc_proc_register() in init_nfs_fs() (Scott Mayhew) [RHEL-39904] {CVE-2024-36939} - drm/radeon: check bo_va->bo is non-NULL before using it (CKI Backport Bot) [RHEL-51184] {CVE-2024-41060} - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). (CKI Backport Bot) [RHEL-51027] {CVE-2024-41041} - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (CKI Backport Bot) [RHEL-50961] {CVE-2024-41035} - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). (CKI Backport Bot) [RHEL-44408] {CVE-2024-37356} - tcp: avoid too many retransmit packets (Florian Westphal) [RHEL-48627] {CVE-2024-41007} - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() (Florian Westphal) [RHEL-48627] - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Florian Westphal) [RHEL-48627] - tcp: refactor tcp_retransmit_timer() (Florian Westphal) [RHEL-48627] - tcp: exit if nothing to retransmit on RTO timeout (Florian Westphal) [RHEL-48627] - netfilter: nf_tables: Reject tables of unsupported family (Florian Westphal) [RHEL-21418] {CVE-2023-6040} - [rt] build kernel-rt-4.18.0-553.17.1.rt7.358.el8_10 [RHEL-53529] - kyber: fix out of bounds access when preempted (Ming Lei) [RHEL-27258] {CVE-2021-46984} - vfs: don't mod negative dentry count when on shrinker list (Brian Foster) [RHEL-35874] - fs/dcache: Re-use value stored to dentry->d_flags instead of re-reading (Brian Foster) [RHEL-35874] - fbmem: Do not delete the mode that is still in use (CKI Backport Bot) [RHEL-37796] {CVE-2021-47338} - netpoll: Fix race condition in netpoll_owner_active (CKI Backport Bot) [RHEL-49361] {CVE-2024-41005} - firmware: arm_scpi: Fix string overflow in SCPI genpd driver (Mark Salter) [RHEL-43702] {CVE-2021-47609} - ipv6: prevent possible NULL dereference in rt6_probe() (Guillaume Nault) [RHEL-48149] {CVE-2024-40960} - HID: i2c-hid-of: fix NULL-deref on failed power up (CKI Backport Bot) [RHEL-31598] {CVE-2024-26717} - cpufreq: amd-pstate: fix memory leak on CPU EPP exit (CKI Backport Bot) [RHEL-48489] {CVE-2024-40997} - x86/mm/pat: fix VM_PAT handling in COW mappings (Chris von Recklinghausen) [RHEL-37258] {CVE-2024-35877} - PCI/PM: Drain runtime-idle callbacks before driver removal (Myron Stowe) [RHEL-42937] {CVE-2024-35809} - PCI: Drop pci_device_remove() test of pci_dev->driver (Myron Stowe) [RHEL-42937] {CVE-2024-35809} - drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() (Mika Penttilä) [RHEL-26909] {CVE-2023-52470} - USB: core: Fix hang in usb_kill_urb by adding memory barriers (Desnes Nunes) [RHEL-43979] {CVE-2022-48760} - cifs: fix bad fids sent over wire (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB311_posix_mkdir (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB2_tcon (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB2_open (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB2_ioctl (Paulo Alcantara) [RHEL-52517] - selftests: forwarding: devlink_lib: Wait for udev events after reloading (Mark Langsdorf) [RHEL-47642] {CVE-2024-39501} - drivers: core: synchronize really_probe() and dev_uevent() (Mark Langsdorf) [RHEL-47642] {CVE-2024-39501} - udp: do not accept non-tunnel GSO skbs landing in a tunnel (Xin Long) [RHEL-42997] {CVE-2024-35884} - filelock: Remove locks reliably when fcntl/close race is detected (Bill O'Donnell) [RHEL-50170] {CVE-2024-41012} - Input: add bounds checking to input_set_capability() (Benjamin Tissoires) [RHEL-21413] {CVE-2022-48619} - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() (CKI Backport Bot) [RHEL-48130] {CVE-2024-40959} - blk-cgroup: fix list corruption from reorder of WRITE ->lqueued (Ming Lei) [RHEL-33695] - blk-cgroup: fix list corruption from resetting io stat (Ming Lei) [RHEL-33695] - net: do not leave a dangling sk pointer, when socket creation fails (CKI Backport Bot) [RHEL-48060] {CVE-2024-40954} - perf/x86/lbr: Filter vsyscall addresses (Michael Petlan) [RHEL-28991] {CVE-2023-52476} - vmci: prevent speculation leaks by sanitizing event in event_deliver() (CKI Backport Bot) [RHEL-47678] {CVE-2024-39499} - serial: core: fix transmit-buffer reset and memleak (Steve Best) [RHEL-38731] {CVE-2021-47527} - powerpc/pseries: Whitelist dtl slub object for copying to userspace (Mamatha Inamdar) [RHEL-51236] {CVE-2024-41065} - powerpc/eeh: avoid possible crash when edev->pdev changes (Mamatha Inamdar) [RHEL-51220] {CVE-2024-41064} - x86: stop playing stack games in profile_pc() (Steve Best) [RHEL-51643] {CVE-2024-42096} - mptcp: ensure snd_una is properly initialized on connect (Florian Westphal) [RHEL-47933 RHEL-47934] {CVE-2024-40931} - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet (CKI Backport Bot) [RHEL-47492] {CVE-2024-39506} - tun: add missing verification for short frame (Patrick Talbert) [RHEL-50194] {CVE-2024-41091} - tap: add missing verification for short frame (Patrick Talbert) [RHEL-50279] {CVE-2024-41090} - usb-storage: alauda: Check whether the media is initialized (Desnes Nunes) [RHEL-43708] {CVE-2024-38619} - usb-storage: alauda: Fix uninit-value in alauda_check_media() (Desnes Nunes) [RHEL-43708] {CVE-2024-38619} - hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37723] {CVE-2021-47384} - block: fix that util can be greater than 100% (Ming Lei) [RHEL-23074] - block: support to account io_ticks precisely (Ming Lei) [RHEL-23074] - watchdog: Fix possible use-after-free by calling del_timer_sync() (Steve Best) [RHEL-38795] {CVE-2021-47321} - hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37719] {CVE-2021-47385} - mlxsw: spectrum: Protect driver from buggy firmware (CKI Backport Bot) [RHEL-42245] {CVE-2021-47560} - mlxsw: Verify the accessed index doesn't exceed the array length (CKI Backport Bot) [RHEL-42245] {CVE-2021-47560} - dm: call the resume method on internal suspend (Benjamin Marzinski) [RHEL-41835] {CVE-2024-26880} - tty: Fix out-of-bound vmalloc access in imageblit (Steve Best) [RHEL-37727] {CVE-2021-47383} - hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37715] {CVE-2021-47386} - hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs (Steve Best) [RHEL-37710] {CVE-2021-47393} - nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells (Steve Best) [RHEL-38436] {CVE-2021-47497} - driver core: auxiliary bus: Fix memory leak when driver_register() fail (Steve Best) [RHEL-37901] {CVE-2021-47287} - phylib: fix potential use-after-free (cki-backport-bot) [RHEL-43764] {CVE-2022-48754} - ptp: Fix possible memory leak in ptp_clock_register() (Hangbin Liu) [RHEL-38424] {CVE-2021-47455} - NFSv4: Fix memory leak in nfs4_set_security_label (CKI Backport Bot) [RHEL-51315] {CVE-2024-41076} - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER (CKI Backport Bot) [RHEL-51618] {CVE-2024-42090} - ftruncate: pass a signed offset (CKI Backport Bot) [RHEL-51598] {CVE-2024-42084} - af_unix: Fix garbage collector racing against connect() (Felix Maurer) [RHEL-34225] {CVE-2024-26923} - virtio-net: Add validation for used length (Laurent Vivier) [RHEL-42080] {CVE-2021-47352} - net: fix possible store tearing in neigh_periodic_work() (Antoine Tenart) [RHEL-42359] {CVE-2023-52522} - tunnels: fix out of bounds access when building IPv6 PMTU error (Antoine Tenart) [RHEL-41823] {CVE-2024-26665} - vt_ioctl: fix array_index_nospec in vt_setactivate (John W. Linville) [RHEL-49141] {CVE-2022-48804} - Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() (CKI Backport Bot) [RHEL-38302] {CVE-2023-52840} - netns: Make get_net_ns() handle zero refcount net (Antoine Tenart) [RHEL-48105] {CVE-2024-40958} - tracing: Ensure visibility when inserting an element into tracing_map (Michael Petlan) [RHEL-30457] {CVE-2024-26645} - KVM: s390: fix LPSWEY handling (CKI Backport Bot) [RHEL-50072] - firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files (CKI Backport Bot) [RHEL-51144] {CVE-2024-41056} - SUNRPC: Fix a race to wake a sync task (Benjamin Coddington) [RHEL-11843] - firmware: cs_dsp: Fix overflow checking of wmfw header (CKI Backport Bot) [RHEL-50999] {CVE-2024-41039} - firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers (CKI Backport Bot) [RHEL-50987] {CVE-2024-41038} - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (Xin Long) [RHEL-48471] {CVE-2024-40995} - net: fix out-of-bounds access in ops_init (Xin Long) [RHEL-43185] {CVE-2024-36883} - x86/mce/therm_throt: Undo thermal polling properly on CPU offline (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Do not access uninitialized therm_work (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Mark throttle_active_work() as __maybe_unused (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Mask out read-only and reserved MSR bits (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Optimize notifications of thermal throttle (Steve Best) [RHEL-45310] - jiffies: add utility function to calculate delta in ms (Steve Best) [RHEL-45310] - x86/mce: Lower throttling MCE messages' priority to warning (Steve Best) [RHEL-45310] - dmaengine: idxd: Fix oops during rmmod on single-CPU platforms (Eder Zulian) [RHEL-37361] {CVE-2024-35989} - xfs: don't walk off the end of a directory data block (CKI Backport Bot) [RHEL-50879] {CVE-2024-41013} - xfs: add bounds checking to xlog_recover_process_data (CKI Backport Bot) [RHEL-50856] {CVE-2024-41014} - dm-crypt: limit the size of encryption requests (Benjamin Marzinski) [RHEL-29330] - netfilter: flowtable: remove nf_ct_l4proto_find() call (Florian Westphal) [RHEL-49589] - [rt] build kernel-rt-4.18.0-553.16.1.rt7.357.el8_10 [RHEL-44553] - x86/bhi: Fix incorrect CLEAR_BRANCH_HISTORY position in entry_INT80_compat (Waiman Long) [RHEL-50648] - [rt] build kernel-rt-4.18.0-553.15.1.rt7.356.el8_10 [RHEL-44553] - Revert "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-44613] - ionic: fix use after netif_napi_del() (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - ionic: clean interrupt before enabling queue to avoid credit race (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change (CKI Backport Bot) [RHEL-49321] {CVE-2021-47624} - xhci: Handle TD clearing for multiple streams case (CKI Backport Bot) [RHEL-47882] {CVE-2024-40927} - net: openvswitch: Fix Use-After-Free in ovs_ct_exit (cki-backport-bot) [RHEL-36362] {CVE-2024-27395} - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: fix vlan use-after-free (cki-backport-bot) [RHEL-43721] {CVE-2024-36979} - irqchip/gic-v3-its: Prevent double free on error (Charles Mirabile) [RHEL-37022] {CVE-2024-35847} - irqchip/gic-v3-its: Fix potential VPE leak on error (Charles Mirabile) [RHEL-37744] {CVE-2021-47373} - i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() (Charles Mirabile) [RHEL-34735] {CVE-2022-48632} - iommu/dma: fix zeroing of bounce buffer padding used by untrusted devices (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: remove alloc_size argument to swiotlb_tbl_map_single() (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: fix swiotlb_bounce() to do partial sync's correctly (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Reinstate page-alignment for mappings >= PAGE_SIZE (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix alignment checks when both allocation and DMA masks are present (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix double-allocation of slots due to broken alignment handling (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (cki-backport-bot) [RHEL-44441] {CVE-2024-31076} - [rt] build kernel-rt-4.18.0-553.14.1.rt7.355.el8_10 [RHEL-44553] - s390/qeth: Fix kernel panic after setting hsuid (Mete Durlu) [RHEL-49754] - perf/core: Protect event sibling list locking against interrupt inversion (Daniel Vacek) [RHEL-31798] - vt: fix unicode buffer corruption when deleting characters (Steve Best) [RHEL-36936] {CVE-2024-35823} - cifs: translate network errors on send to -ECONNABORTED (Paulo Alcantara) [RHEL-36754] - xfs: don't block in busy flushing when freeing extents (Brian Foster) [RHEL-7984] - xfs: allow extent free intents to be retried (Brian Foster) [RHEL-7984] - xfs: pass alloc flags through to xfs_extent_busy_flush() (Brian Foster) [RHEL-7984] - xfs: use deferred frees for btree block freeing (Brian Foster) [RHEL-7984] - xfs: fix bounds check in xfs_defer_agfl_block() (Brian Foster) [RHEL-7984] - xfs: validate block number being freed before adding to xefi (Brian Foster) [RHEL-7984] - xfs: rename xfs_bmap_add_free to xfs_free_extent_later (Brian Foster) [RHEL-7984] - usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (Desnes Nunes) [RHEL-36803] {CVE-2024-35790} - stm class: Fix a double free in stm_register_device() (Steve Best) [RHEL-44514] {CVE-2024-38627} - s390/qeth: Fix potential loss of L3-IP@ in case of network issues (Mete Durlu) [RHEL-49755] - tls: fix missing memory barrier in tls_init (cki-backport-bot) [RHEL-44471] {CVE-2024-36489} - xfs: fix log recovery buffer allocation for the legacy h_size fixup (Bill O'Donnell) [RHEL-46473] {CVE-2024-39472} - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: use __for_each_thread() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - exit: Use the correct exit_code in /proc/<pid>/stat (Brian Foster) [RHEL-31562] {CVE-2024-26686} - scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool (Ewan D. Milne) [RHEL-38283] {CVE-2023-52811} - scsi: qla2xxx: Fix double free of fcport (Ewan D. Milne) [RHEL-39549] {CVE-2024-26929} - scsi: qla2xxx: Fix double free of the ha->vp_map pointer (Ewan D. Milne) [RHEL-39549] {CVE-2024-26930} - scsi: qla2xxx: Fix command flush on cable pull (Ewan D. Milne) [RHEL-39549] {CVE-2024-26931} - [rt] build kernel-rt-4.18.0-553.13.1.rt7.354.el8_10 [RHEL-44553] - redhat: remove handling of deleted rhdocs/ directory from genspec.sh (Denys Vlasenko) - x86/bugs: Fix BHI retpoline check (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI handling of RRSBA (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr' (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI documentation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix return type of spectre_bhi_state() (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Make CONFIG_SPECTRE_BHI_ON the default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Mitigate KVM by default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add BHI mitigation knob (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Enumerate Branch History Injection (BHI) bug (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Define SPEC_CTRL_BHI_DIS_S (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add support for clearing branch history at syscall entry (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file (Waiman Long) [RHEL-28202] - perf/x86/amd/lbr: Use freeze based on availability (Waiman Long) [RHEL-28202] - Documentation/kernel-parameters: Add spec_rstack_overflow to mitigations=off (Waiman Long) [RHEL-28202] - KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace (Waiman Long) [RHEL-28202] - x86/bugs: Reset speculation control settings on init (Waiman Long) [RHEL-28202] - KVM: x86: Update KVM-only leaf handling to allow for 100% KVM-only leafs (Waiman Long) [RHEL-28202] - KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest (Waiman Long) [RHEL-28202] - mptcp: ensure snd_nxt is properly initialized on connect (Davide Caratti) [RHEL-39865] {CVE-2024-36889} - powerpc/pseries: Enforce hcall result buffer validity and size (Mamatha Inamdar) [RHEL-48291] {CVE-2024-40974} - wifi: mac80211: fix potential key use-after-free (Jose Ignacio Tornos Martinez) [RHEL-28007] {CVE-2023-52530} - cppc_cpufreq: Fix possible null pointer dereference (Mark Langsdorf) [RHEL-44137] {CVE-2024-38573} - net/sched: act_mirred: use the backlog for mirred ingress (Davide Caratti) [RHEL-31718] {CVE-2024-26740} - vfio/pci: Lock external INTx masking ops (Alex Williamson) [RHEL-31922] {CVE-2024-26810} - net: sched: sch_multiq: fix possible OOB write in multiq_tune() (Davide Caratti) [RHEL-43464] {CVE-2024-36978} - tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized (Guillaume Nault) [RHEL-37850] {CVE-2021-47304} - pstore/ram: Fix crash when setting number of cpus to an odd number (Lenny Szubowicz) [RHEL-29471] {CVE-2023-52619} - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node (Jocelyn Falempe) [RHEL-37101] {CVE-2023-52662} - drm/vmwgfx: Fix the lifetime of the bo cursor memory (Jocelyn Falempe) [RHEL-36962] {CVE-2024-35810} - drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed (Jocelyn Falempe) [RHEL-34987] {CVE-2024-26940} - drm/vmwgfx: Unmap the surface before resetting it on a plane state (Jocelyn Falempe) [RHEL-35217] {CVE-2023-52648} - drm/vmwgfx: Fix invalid reads in fence signaled events (Jocelyn Falempe) [RHEL-40010] {CVE-2024-36960} - block: Fix wrong offset in bio_truncate() (Ming Lei) [RHEL-43782] {CVE-2022-48747} - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CKI Backport Bot) [RHEL-46913] {CVE-2024-39487} - net: fix __dst_negative_advice() race (Xin Long) [RHEL-41183] {CVE-2024-36971} - igc: avoid returning frame twice in XDP_REDIRECT (Corinna Vinschen) [RHEL-33264] {CVE-2024-26853} - mac802154: fix llsec key resources release in mac802154_llsec_key_del (Steve Best) [RHEL-34967] {CVE-2024-26961} - cpufreq: exit() callback is optional (Mark Langsdorf) [RHEL-43840] {CVE-2024-38615} - cifs: prevent infinite recursion in CIFSGetDFSRefer() (Paulo Alcantara) [RHEL-34672] - cifs: lock chan_lock outside match_session (Paulo Alcantara) [RHEL-34672] - smb3: workaround negprot bug in some Samba servers (Paulo Alcantara) [RHEL-34672] - smb3: use netname when available on secondary channels (Paulo Alcantara) [RHEL-34672] - smb3: fix empty netname context on secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: populate empty hostnames for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: always iterate smb sessions using primary channel (Paulo Alcantara) [RHEL-34672] - cifs: Fix connections leak when tlink setup failed (Paulo Alcantara) [RHEL-34672] - cifs: Fix memory leak when build ntlmssp negotiate blob failed (Paulo Alcantara) [RHEL-34672] - cifs: always initialize struct msghdr smb_msg completely (Paulo Alcantara) [RHEL-34672] - cifs: don't send down the destination address to sendmsg for a SOCK_STREAM (Paulo Alcantara) [RHEL-34672] - cifs: revalidate mapping when doing direct writes (Paulo Alcantara) [RHEL-34672] - cifs: skip extra NULL byte in filenames (Paulo Alcantara) [RHEL-34672] - cifs: list_for_each() -> list_for_each_entry() (Paulo Alcantara) [RHEL-34672] - smb2: small refactor in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - cifs: Fix crash on unload of cifs_arc4.ko (Paulo Alcantara) [RHEL-34672] - cifs: remove check of list iterator against head past the loop body (Paulo Alcantara) [RHEL-34672] - cifs: fix reconnect on smb3 mount types (Paulo Alcantara) [RHEL-34672] - cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (Paulo Alcantara) [RHEL-34672] - cifs: skip trailing separators of prefix paths (Paulo Alcantara) [RHEL-34672] - cifs: fix ntlmssp on old servers (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL ptr dereference in refresh_mounts() (Paulo Alcantara) [RHEL-34672] - cifs: do not skip link targets when an I/O fails (Paulo Alcantara) [RHEL-34672] - cifs: fix confusing unneeded warning message on smb2.1 and earlier (Paulo Alcantara) [RHEL-34672] - smb3: fix snapshot mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix workstation_name for multiuser mounts (Paulo Alcantara) [RHEL-34672] - cifs: alloc_path_with_tree_prefix: do not append sep. if the path is empty (Paulo Alcantara) [RHEL-34672] - cifs: free ntlmsspblob allocated in negotiate (Paulo Alcantara) [RHEL-34672] - cifs: avoid use of dstaddr as key for fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: add server conn_id to fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: fix missed refcounting of ipc tcon (Paulo Alcantara) [RHEL-34672] - smb2: clarify rc initialization in smb2_reconnect (Paulo Alcantara) [RHEL-34672] - cifs: populate server_hostname for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should be set on new server (Paulo Alcantara) [RHEL-34672] - cifs: introduce cifs_ses_mark_for_reconnect() helper (Paulo Alcantara) [RHEL-34672] - cifs: protect srv_count with cifs_tcp_ses_lock (Paulo Alcantara) [RHEL-34672] - cifs: move debug print out of spinlock (Paulo Alcantara) [RHEL-34672] - cifs: do not duplicate fscache cookie for secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: connect individual channel servers to primary channel server (Paulo Alcantara) [RHEL-34672] - cifs: protect session channel fields with chan_lock (Paulo Alcantara) [RHEL-34672] - cifs: do not negotiate session if session already exists (Paulo Alcantara) [RHEL-34672] - smb3: do not setup the fscache_super_cookie until fsinfo initialized (Paulo Alcantara) [RHEL-34672] - cifs: fix potential use-after-free bugs (Paulo Alcantara) [RHEL-34672] - cifs: release lock earlier in dequeue_mid error case (Paulo Alcantara) [RHEL-34672] - smb3: remove trivial dfs compile warning (Paulo Alcantara) [RHEL-34672] - cifs: support nested dfs links over reconnect (Paulo Alcantara) [RHEL-34672] - cifs: for compound requests, use open handle if possible (Paulo Alcantara) [RHEL-34672] - cifs: split out dfs code from cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant (Paulo Alcantara) [RHEL-34672] - cifs: introduce new helper for cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: fix print of hdr_flags in dfscache_proc_show() (Paulo Alcantara) [RHEL-34672] - cifs: send workstation name during ntlmssp session setup (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should not share socket with future sessions (Paulo Alcantara) [RHEL-34672] - smb3: add dynamic trace points for socket connection (Paulo Alcantara) [RHEL-34672] - cifs: Move SMB2_Create definitions to the shared area (Paulo Alcantara) [RHEL-34672] - cifs: Move more definitions into the shared area (Paulo Alcantara) [RHEL-34672] - cifs: move NEGOTIATE_PROTOCOL definitions out into the common area (Paulo Alcantara) [RHEL-34672] - cifs: Create a new shared file holding smb2 pdu definitions (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect check for null pointer in header_assemble (Paulo Alcantara) [RHEL-34672] - smb3: correct server pointer dereferencing check to be more consistent (Paulo Alcantara) [RHEL-34672] - cifs: Deal with some warnings from W=1 (Paulo Alcantara) [RHEL-34672] - cifs: fix a sign extension bug (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect kernel doc comments (Paulo Alcantara) [RHEL-34672] - cifs: remove pathname for file from SPDX header (Paulo Alcantara) [RHEL-34672] - cifs: move SMB FSCTL definitions to common code (Paulo Alcantara) [RHEL-34672] - cifs: rename cifs_common to smbfs_common (Paulo Alcantara) [RHEL-34672] - cifs: update FSCTL definitions (Paulo Alcantara) [RHEL-34672] - cifs: cifs_md4 convert to SPDX identifier (Paulo Alcantara) [RHEL-34672] - cifs: create a MD4 module and switch cifs.ko to use it (Paulo Alcantara) [RHEL-34672] - cifs: fork arc4 and create a separate module for it for cifs and other users (Paulo Alcantara) [RHEL-34672] - smb3: fix posix extensions mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix wrong release in sess_alloc_buffer() failed path (Paulo Alcantara) [RHEL-34672] - CIFS: Fix a potencially linear read overflow (Paulo Alcantara) [RHEL-34672] - cifs: use the correct max-length for dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: create sd context must be a multiple of 8 (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp sessions of dfs connections (Paulo Alcantara) [RHEL-34672] - cifs: added WARN_ON for all the count decrements (Paulo Alcantara) [RHEL-34672] - cifs: fix missing null session check in mount (Paulo Alcantara) [RHEL-34672] - cifs: handle reconnect of tcon when there is no cached dfs referral (Paulo Alcantara) [RHEL-34672] - cifs: fix the out of range assignment to bit fields in parse_server_interfaces (Paulo Alcantara) [RHEL-34672] - smb3: fix typo in header file (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: Add support for negotiating signing algorithm (Paulo Alcantara) [RHEL-34672] - cifs: prevent NULL deref in cifs_compose_mount_options() (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL dereference in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - smbdirect: missing rc checks while waiting for rdma events (Paulo Alcantara) [RHEL-34672] - cifs: Avoid field over-reading memcpy() (Paulo Alcantara) [RHEL-34672] - smb311: remove dead code for non compounded posix query info (Paulo Alcantara) [RHEL-34672] - cifs: fix SMB1 error path in cifs_get_file_info_unix (Paulo Alcantara) [RHEL-34672] - smb3: fix uninitialized value for port in witness protocol move (Paulo Alcantara) [RHEL-34672] - cifs: fix unneeded null check (Paulo Alcantara) [RHEL-34672] - cifs: use SPDX-Licence-Identifier (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in cifs_debug.c (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in smb2misc.c (Paulo Alcantara) [RHEL-34672] - cifs: missed ref-counting smb session in find (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp servers with dfs mounts (Paulo Alcantara) [RHEL-34672] - cifs: set a minimum of 2 minutes for refreshing dfs cache (Paulo Alcantara) [RHEL-34672] - cifs: Remove unused inline function is_sysvol_or_netlogon() (Paulo Alcantara) [RHEL-34672] - cifs: remove duplicated prototype (Paulo Alcantara) [RHEL-34672] - cifs: fix ipv6 formating in cifs_ses_add_channel (Paulo Alcantara) [RHEL-34672] - cifs: fix string declarations and assignments in tracepoints (Paulo Alcantara) [RHEL-34672] - cifs: fix memory leak in smb2_copychunk_range (Paulo Alcantara) [RHEL-34672] - SMB3: incorrect file id in requests compounded with open (Paulo Alcantara) [RHEL-34672] - smb3: if max_channels set to more than one channel request multichannel (Paulo Alcantara) [RHEL-34672] - smb3: do not attempt multichannel to server which does not support it (Paulo Alcantara) [RHEL-34672] - smb3: when mounting with multichannel include it in requested capabilities (Paulo Alcantara) [RHEL-34672] - cifs: simplify SWN code with dummy funcs instead of ifdefs (Paulo Alcantara) [RHEL-34672] - cifs: log mount errors using cifs_errorf() (Paulo Alcantara) [RHEL-34672] - cifs: switch build_path_from_dentry() to using dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: fix out-of-bound memory access when calling smb3_notify() at mount point (Paulo Alcantara) [RHEL-34672] - cifs: allocate buffer in the caller of build_path_from_dentry() (Paulo Alcantara) [RHEL-34672] - cifs: make build_path_from_dentry() return const char * (Paulo Alcantara) [RHEL-34672] - cifs: remove old dead code (Paulo Alcantara) [RHEL-34672] - fs: cifs: Remove repeated struct declaration (Paulo Alcantara) [RHEL-34672] - cifs: have cifs_fattr_to_inode() refuse to change type on live inode (Paulo Alcantara) [RHEL-34672] - cifs: have ->mkdir() handle race with another client sanely (Paulo Alcantara) [RHEL-34672] - do_cifs_create(): don't set ->i_mode of something we had not created (Paulo Alcantara) [RHEL-34672] - cifs: Silently ignore unknown oplock break handle (Paulo Alcantara) [RHEL-34672] - cifs: change noisy error message to FYI (Paulo Alcantara) [RHEL-34672] - cifs: print MIDs in decimal notation (Paulo Alcantara) [RHEL-34672] - cifs: minor simplification to smb2_is_network_name_deleted (Paulo Alcantara) [RHEL-34672] - TCON Reconnect during STATUS_NETWORK_NAME_DELETED (Paulo Alcantara) [RHEL-34672] - cifs: clarify hostname vs ip address in /proc/fs/cifs/DebugData (Paulo Alcantara) [RHEL-34672] - cifs: change confusing field serverName (to ip_addr) (Paulo Alcantara) [RHEL-34672] - cifs: Reformat DebugData and index connections by conn_id. (Paulo Alcantara) [RHEL-34672] - cifs: Identify a connection by a conn_id. (Paulo Alcantara) [RHEL-34672] - smb3: negotiate current dialect (SMB3.1.1) when version 3 or greater requested (Paulo Alcantara) [RHEL-34672] - smb3: Fix out-of-bounds bug in SMB2_negotiate() (Paulo Alcantara) [RHEL-34672] - fs/cifs: Simplify bool comparison. (Paulo Alcantara) [RHEL-34672] - fs/cifs: Assign boolean values to a bool variable (Paulo Alcantara) [RHEL-34672] - cifs: Avoid error pointer dereference (Paulo Alcantara) [RHEL-34672] - cifs: Re-indent cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Unlock on errors in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Delete a stray unlock in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Tracepoints and logs for tracing credit changes. (Paulo Alcantara) [RHEL-34672] - cifs: Fix some error pointers handling detected by static checker (Paulo Alcantara) [RHEL-34672] - smb3: remind users that witness protocol is experimental (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: do not log warning message if server doesn't populate salt (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: update comments clarifying SPNEGO info in negprot response (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot rsp (Paulo Alcantara) [RHEL-34672] - SMB3: avoid confusing warning message on mount to Azure (Paulo Alcantara) [RHEL-34672] - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (Nigel Croxon) [RHEL-46662] {CVE-2024-39476} - net: fix information leakage in /proc/net/ptype (Hangbin Liu) [RHEL-44000] {CVE-2022-48757} - usb: typec: ucsi: Limit read size on v1.2 (Desnes Nunes) [RHEL-37286] {CVE-2024-35924} - minmax: relax check to allow comparison between unsigned arguments and signed constants (Desnes Nunes) [RHEL-37286] - minmax: allow comparisons of 'int' against 'unsigned char/short' (Desnes Nunes) [RHEL-37286] - minmax: allow min()/max()/clamp() if the arguments have the same signedness. (Desnes Nunes) [RHEL-37286] - minmax: add umin(a, b) and umax(a, b) (Desnes Nunes) [RHEL-37286] - minmax: fix header inclusions (Desnes Nunes) [RHEL-37286] - minmax: clamp more efficiently by avoiding extra comparison (Desnes Nunes) [RHEL-37286] - minmax: sanity check constant bounds when clamping (Desnes Nunes) [RHEL-37286] - tracing: Define the is_signed_type() macro once (Desnes Nunes) [RHEL-37286] - linux/bits.h: fix compilation error with GENMASK (Desnes Nunes) [RHEL-37286] - x86/apic: Mask IOAPIC entries when disabling the local APIC (Lenny Szubowicz) [RHEL-18077] - userfaultfd: fix a race between writeprotect and exit_mmap() (Rafael Aquini) [RHEL-38410] {CVE-2021-47461} - mm: khugepaged: skip huge page collapse for special files (Waiman Long) [RHEL-38446] {CVE-2021-47491} - cachefiles: fix memory leak in cachefiles_add_cache() (Andrey Albershteyn) [RHEL-33109] {CVE-2024-26840} - drm/amd/display: Implement bounds check for stream encoder creation in DCN301 (Michel Dänzer) [RHEL-31429] {CVE-2024-26660} - net/mlx5: Discard command completions in internal error (Kamal Heib) [RHEL-44231] {CVE-2024-38555} - drm: Don't unref the same fb many times by mistake due to deadlock handling (CKI Backport Bot) [RHEL-29011] {CVE-2023-52486} - md: fix resync softlockup when bitmap size is less than array size (Nigel Croxon) [RHEL-43942] {CVE-2024-38598} - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation (Davide Caratti) [RHEL-39712] {CVE-2024-36017} - netfilter: nf_tables: discard table flag update with pending basechain deletion (Phil Sutter) [RHEL-37205] {CVE-2024-35897} - netfilter: nf_tables: reject table flag and netdev basechain updates (Phil Sutter) [RHEL-37205] - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (Ewan D. Milne) [RHEL-40172] {CVE-2024-36924} - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (Ewan D. Milne) [RHEL-40172] {CVE-2024-36952} - netfilter: nf_tables: fix memleak in map from abort path (Phil Sutter) [RHEL-35052] {CVE-2024-27011} - netfilter: nf_tables: reject new basechain after table flag update (Phil Sutter) [RHEL-37193] {CVE-2024-35900} - netfilter: nf_tables: flush pending destroy work before exit_net release (Phil Sutter) [RHEL-37197] {CVE-2024-35899} - netfilter: complete validation of user input (Phil Sutter) [RHEL-37210] - netfilter: validate user input for expected length (Phil Sutter) [RHEL-37210] {CVE-2024-35896} - netfilter: tproxy: bail out if IP has been disabled on the device (Phil Sutter) [RHEL-44363] {CVE-2024-36270} - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (Phil Sutter) [RHEL-44532] {CVE-2024-36286} - netfilter: nf_tables: do not compare internal table flags on updates (Phil Sutter) [RHEL-35114] {CVE-2024-27065} - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (Phil Sutter) [RHEL-35028] {CVE-2024-27019} - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (Phil Sutter) [RHEL-35024] {CVE-2024-27020} - netfilter: nf_tables: __nft_expr_type_get() selects specific family type (Phil Sutter) [RHEL-35024] - netfilter: conntrack: serialize hash resizes and cleanups (Phil Sutter) [RHEL-37703] {CVE-2021-47408} - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (Phil Sutter) [RHEL-34217] {CVE-2024-26925} - netfilter: nf_tables: release batch on table validation from abort path (Phil Sutter) [RHEL-34217] - ipvlan: add ipvlan_route_v6_outbound() helper (Davide Caratti) [RHEL-38319] {CVE-2023-52796} - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.23.1.rt7.364.el8_10 [RHEL-59541] - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002] - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924} - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042} - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070} - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898} - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301} - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976} - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540} - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284} - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857} - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924} - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983} - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854} - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936} - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093} - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961} - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880} - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244} - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984} - [rt] build kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 [RHEL-53529] - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071} - [rt] build kernel-rt-4.18.0-553.21.1.rt7.362.el8_10 [RHEL-53529] - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874] - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558} - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441} - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904} - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322} - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246} - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008} - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228} - [rt] build kernel-rt-4.18.0-553.20.1.rt7.361.el8_10 [RHEL-53529] - KVM: arm64: Disassociate vcpus from redistributor region on teardown (Shaoqin Huang) [RHEL-48417] {CVE-2024-40989} - devres: Fix memory leakage caused by driver API devm_free_percpu() (CKI Backport Bot) [RHEL-55597] {CVE-2024-43871} - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (Izabela Bakollari) [RHEL-26680] {CVE-2024-26600} - nvmet-fc: avoid deadlock on delete association path (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - nvmet-fc: release reference on target port (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - ACPI: LPIT: Avoid u32 multiplication overflow (Mark Langsdorf) [RHEL-37062] {CVE-2023-52683} - sched/deadline: Fix task_struct reference leak (Phil Auld) [RHEL-50904] {CVE-2024-41023} - nfsd: fix crash on LOCKT on reexported NFSv3 (Benjamin Coddington) [RHEL-31515] - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path (CKI Backport Bot) [RHEL-26570] {CVE-2024-26595} - mlxsw: spectrum_acl_tcam: Move devlink param to TCAM code (Ivan Vecera) [RHEL-26570] {CVE-2024-26595} - ACPI: extlog: fix NULL pointer dereference check (Mark Langsdorf) [RHEL-29110] {CVE-2023-52605} - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() (Mark Langsdorf) [RHEL-33198] {CVE-2024-26894} - mm: prevent derefencing NULL ptr in pfn_section_valid() (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - mm, kmsan: fix infinite recursion due to RCU critical section (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - cipso: make cipso_v4_skbuff_delattr() fully remove the CIPSO options (Ondrej Mosnacek) [RHEL-30904] - cipso: fix total option length computation (Ondrej Mosnacek) [RHEL-30904] - ext4: do not create EA inode under buffer lock (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: check the return value of ext4_xattr_inode_dec_ref() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (Carlos Maiolino) [RHEL-48507] {CVE-2024-40998} - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - [rt] build kernel-rt-4.18.0-553.19.1.rt7.360.el8_10 [RHEL-53529] - drm/i915/vma: Fix UAF on destroy against retire race (Mika Penttilä) [RHEL-35222] {CVE-2024-26939} - RHEL-48620 (Kenneth Yin) [RHEL-48620] - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (CKI Backport Bot) [RHEL-42721] {CVE-2024-26855} - net: usb: asix: do not force pause frames support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix "can't send until first packet is send" issue (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix modprobe "sysfs: cannot create duplicate filename" (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: add proper error handling of usb read errors (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix wrong return value in asix_check_host_enable() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix uninit-value in asix_mdio_read() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: fix boolconv.cocci warnings (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: do not call phy_disconnect() for ax88178 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: move embedded PHY detection as early as possible (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix uninit value bugs (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add missing stop (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: suspend PHY on driver probe (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: manage PHY PM from MAC (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: add error handling for asix_mdio_* functions (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add phylib support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: refactor asix_read_phy_addr() and handle errors on return (Ken Cox) [RHEL-28108] {CVE-2021-47101} - SUNRPC: always free ctxt when freeing deferred request (Jay Shin) [RHEL-40936] - SUNRPC: double free xprt_ctxt while still in use (Jay Shin) [RHEL-40936] - SUNRPC: Remove svc_rqst::rq_xprt_hlen (Jay Shin) [RHEL-40936] - SUNRPC: Remove dead code in svc_tcp_release_rqst() (Jay Shin) [RHEL-40936] - x86/bugs: Extend VMware Retbleed workaround to Nehalem & earlier CPUs (Waiman Long) [RHEL-48646] - wifi: iwlwifi: read txq->read_ptr under lock (Jose Ignacio Tornos Martinez) [RHEL-39797] {CVE-2024-36922} - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (John Meneghini) [RHEL-39908] {CVE-2024-36919} - nbd: always initialize struct msghdr completely (Ming Lei) [RHEL-29498] {CVE-2024-26638} - block: don't call rq_qos_ops->done_bio if the bio isn't tracked (Ming Lei) [RHEL-42151] {CVE-2021-47412} - nvmet: fix a possible leak when destroy a ctrl during qp establishment (Maurizio Lombardi) [RHEL-52013] {CVE-2024-42152} - ipv6: prevent NULL dereference in ip6_output() (Sabrina Dubroca) [RHEL-39912] {CVE-2024-36901} - ppp: reject claimed-as-LCP but actually malformed packets (Guillaume Nault) [RHEL-51052] {CVE-2024-41044} - leds: trigger: Unregister sysfs attributes before calling deactivate() (CKI Backport Bot) [RHEL-54834] {CVE-2024-43830} - crypto: bcm - Fix pointer arithmetic (cki-backport-bot) [RHEL-44108] {CVE-2024-38579} - scsi: qedf: Ensure the copied buf is NUL terminated (John Meneghini) [RHEL-44195] {CVE-2024-38559} - x86/bhi: Avoid warning in #DB handler due to BHI mitigation (Waiman Long) [RHEL-53657] {CVE-2024-42240} - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (CKI Backport Bot) [RHEL-47529] {CVE-2024-40901} - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (CKI Backport Bot) [RHEL-39843] {CVE-2024-36902} - net: usb: ax88179_178a: improve link status logs (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: improve reset check (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: fix link status when link is set to down/up (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: avoid writing the mac address before first reading (Jose Ignacio Tornos Martinez) [RHEL-45167] - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - media: cec: cec-api: add locking in cec_release() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid confusing "transmit timed out" message (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid recursive cec_claim_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: remove length check of Timer Status (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: count low-drive, error and arb-lost conditions (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add note about *_from_edid() function usage in drm (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_unconfigured() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_nb_transmit_canceled() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: don't set last_initiator if tx in progress (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: disable adapter in cec_devnode_unregister (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: not all messages were passed on when monitoring (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add support for Absolute Volume Control (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: log when claiming LA fails unexpectedly (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: drop activate_cnt, use state info instead (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: reconfigure if the PA changes during configuration (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: fix is_configuring state (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: stop trying LAs on CEC_TX_STATUS_TIMEOUT (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't unconfigure if already unconfigured (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add optional adap_configured callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add xfer_timeout_ms field (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: use call_op and check for !unregistered (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix interrupt en/disable handling (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: drop unused 'enabled' field from struct cec_pin (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix off-by-one SFT check (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: rename timer overrun variables (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: correctly pass on reply results (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: abort if the current transmit was canceled (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: call enable_adap on s_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: media/cec.h: document cec_adapter fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix a deadlock situation (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: safely unhook lists in cec_data (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: copy sequence field for the reply (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix trivial style warnings (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: add 'unregistered' checks (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't use flush_scheduled_work() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: Use fallthrough pseudo-keyword (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: remove unused waitq and phys_addrs fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: silence shift wrapping warning in __cec_s_log_addrs() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: move the core to a separate directory (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - net/iucv: Avoid explicit cpumask var allocation on stack (CKI Backport Bot) [RHEL-51631] {CVE-2024-42094} - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (Dick Kennedy) [RHEL-40400] - KVM: selftests: Make hyperv_clock require TSC based system clocksource (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Run clocksource dependent tests with hyperv_clocksource_tsc_page too (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Use generic sys_clocksource_is_tsc() in vmx_nested_tsc_scaling_test (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Generalize check_clocksource() from kvm_clock_test (Vitaly Kuznetsov) [RHEL-19027] - firmware: cs_dsp: Return error if block header overflows file (CKI Backport Bot) [RHEL-53646] {CVE-2024-42238} - firmware: cs_dsp: Validate payload length before processing block (CKI Backport Bot) [RHEL-53638] {CVE-2024-42237} - mm, slub: fix potential memoryleak in kmem_cache_open() (Waiman Long) [RHEL-38404] {CVE-2021-47466} - slub: don't panic for memcg kmem cache creation failure (Waiman Long) [RHEL-38404] {CVE-2021-47466} - wifi: ath11k: fix htt pktlog locking (Jose Ignacio Tornos Martinez) [RHEL-38317] {CVE-2023-52800} - wifi: ath11k: fix dfs radar event locking (Jose Ignacio Tornos Martinez) [RHEL-38165] {CVE-2023-52798} - lib/generic-radix-tree.c: Don't overflow in peek() (Waiman Long) [RHEL-37737] {CVE-2021-47432} - include/linux/generic-radix-tree.h: replace kernel.h with the necessary inclusions (Waiman Long) [RHEL-37737] {CVE-2021-47432} - EDAC/i10nm: Skip the absent memory controllers (Aristeu Rozanski) [RHEL-43236] - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (John Meneghini) [RHEL-38197] {CVE-2023-52809} - gfs2: Fix potential glock use-after-free on unmount (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: simplify gdlm_put_lock with out_free label (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: Remove ill-placed consistency check (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - nvme-fc: do not wait in vain when unloading module (Ewan D. Milne) [RHEL-33083] {CVE-2024-26846} - HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts (CKI Backport Bot) [RHEL-49698] {CVE-2022-48866} - scsi: qedf: Set qed_slowpath_params to zero before use (John Meneghini) [RHEL-9797] - scsi: qedf: Wait for stag work during unload (John Meneghini) [RHEL-9797] - scsi: qedf: Don't process stag work during unload and recovery (John Meneghini) [RHEL-9797] - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - mm: avoid overflows in dirty throttling logic (Audra Mitchell) [RHEL-51840] {CVE-2024-42131} - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - ACPI: fix NULL pointer dereference (Mark Langsdorf) [RHEL-37897] {CVE-2021-47289} - [rt] build kernel-rt-4.18.0-553.18.1.rt7.359.el8_10 [RHEL-53529] - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING (Ewan D. Milne) [RHEL-39805] {CVE-2024-36920} - tun: limit printing rate when illegal packet received by tun dev (Jon Maloy) [RHEL-35046] {CVE-2024-27013} - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu/mes: fix use-after-free issue (Michel Dänzer) [RHEL-44043] {CVE-2024-38581} - drm/amdgpu: Fix the null pointer when load rlc firmware (Michel Dänzer) [RHEL-30603] {CVE-2024-26649} - drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (Michel Dänzer) [RHEL-35160] {CVE-2024-27042} - net/sched: Fix UAF when resolving a clash (Xin Long) [RHEL-51014] {CVE-2024-41040} - tcp_metrics: validate source addr length (Guillaume Nault) [RHEL-52025] {CVE-2024-42154} - NFSv4/pnfs: Fix a use-after-free bug in open (Benjamin Coddington) [RHEL-35508] - NFSv4: Don't hold the layoutget locks across multiple RPC calls (Benjamin Coddington) [RHEL-35508] - scsi: qedf: Make qedf_execute_tmf() non-preemptible (John Meneghini) [RHEL-51799] {CVE-2024-42124} - Input: elantech - fix stack out of bound access in elantech_change_report_id() (CKI Backport Bot) [RHEL-41938] {CVE-2021-47097} - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (CKI Backport Bot) [RHEL-28982] {CVE-2023-52478} - drm/radeon: fix UBSAN warning in kv_dpm.c (CKI Backport Bot) [RHEL-48399] {CVE-2024-40988} - usb: core: Don't hold the device lock while sleeping in do_proc_control() (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - USB: core: Make do_proc_control() and do_proc_bulk() killable (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - scsi: qedi: Fix crash while reading debugfs attribute (CKI Backport Bot) [RHEL-48327] {CVE-2024-40978} - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CKI Backport Bot) [RHEL-48309] {CVE-2024-40977} - net: tcp: accept old ack during closing (Jamie Bainbridge) [RHEL-52433] - wifi: iwlwifi: mvm: don't read past the mfuart notifcation (CKI Backport Bot) [RHEL-48016] {CVE-2024-40941} - net/iucv: fix use after free in iucv_sock_close() (Mete Durlu) [RHEL-53988] - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (CKI Backport Bot) [RHEL-47908] {CVE-2024-40929} - Input: aiptek - properly check endpoint type (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - use descriptors of current altsetting (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - fix endpoint sanity check (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB (CKI Backport Bot) [RHEL-52373] {CVE-2024-42226} - wifi: mt76: replace skb_put with skb_put_zero (CKI Backport Bot) [RHEL-52366] {CVE-2024-42225} - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (CKI Backport Bot) [RHEL-47776] {CVE-2024-40912} - wifi: cfg80211: Lock wiphy in cfg80211_get_station (CKI Backport Bot) [RHEL-47758] {CVE-2024-40911} - VMCI: Use struct_size() in kmalloc() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() (Steve Best) [RHEL-37325] {CVE-2024-35944} - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values (Jose Ignacio Tornos Martinez) [RHEL-51761] {CVE-2024-42114} - usb: atm: cxacru: fix endpoint checking in cxacru_bind() (CKI Backport Bot) [RHEL-51442] {CVE-2024-41097} - nfs: handle error of rpc_proc_register() in init_nfs_fs() (Scott Mayhew) [RHEL-39904] {CVE-2024-36939} - drm/radeon: check bo_va->bo is non-NULL before using it (CKI Backport Bot) [RHEL-51184] {CVE-2024-41060} - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). (CKI Backport Bot) [RHEL-51027] {CVE-2024-41041} - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (CKI Backport Bot) [RHEL-50961] {CVE-2024-41035} - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). (CKI Backport Bot) [RHEL-44408] {CVE-2024-37356} - tcp: avoid too many retransmit packets (Florian Westphal) [RHEL-48627] {CVE-2024-41007} - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() (Florian Westphal) [RHEL-48627] - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Florian Westphal) [RHEL-48627] - tcp: refactor tcp_retransmit_timer() (Florian Westphal) [RHEL-48627] - tcp: exit if nothing to retransmit on RTO timeout (Florian Westphal) [RHEL-48627] - netfilter: nf_tables: Reject tables of unsupported family (Florian Westphal) [RHEL-21418] {CVE-2023-6040} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.23.1.rt7.364.el8_10 [RHEL-59541] - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002] - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924} - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042} - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070} - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898} - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301} - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976} - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540} - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284} - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857} - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924} - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983} - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854} - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936} - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093} - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961} - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880} - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244} - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984} - [rt] build kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 [RHEL-53529] - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071} - [rt] build kernel-rt-4.18.0-553.21.1.rt7.362.el8_10 [RHEL-53529] - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874] - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558} - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441} - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904} - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322} - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246} - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008} - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228} - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.23.1.rt7.364.el8_10 [RHEL-59541] - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002] - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924} - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042} - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070} - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898} - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301} - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976} - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540} - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284} - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857} - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924} - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983} - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854} - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936} - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093} - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961} - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880} - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244} - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - [rt] build kernel-rt-4.18.0-553.35.1.rt7.376.el8_10 [RHEL-72569] - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480] - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480] - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396] - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - [rt] build kernel-rt-4.18.0-553.35.1.rt7.376.el8_10 [RHEL-72569] - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480] - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480] - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396] - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - [rt] build kernel-rt-4.18.0-553.35.1.rt7.376.el8_10 [RHEL-72569] - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480] - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480] - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396] - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.5.1.rt7.346.el8_10 [RHEL-34640] - tools/power/turbostat: Fix uncore frequency file string (David Arcari) [RHEL-29238] - tools/power turbostat: Expand probe_intel_uncore_frequency() (David Arcari) [RHEL-29238] - uio: Fix use-after-free in uio_open (Ricardo Robaina) [RHEL-26232] {CVE-2023-52439} - net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (Ken Cox) [RHEL-27316] {CVE-2021-47013} - keys: Fix linking a duplicate key to a keyring's assoc_array (David Howells) [RHEL-30772] - keys: Hoist locking out of __key_link_begin() (David Howells) [RHEL-30772] - keys: Break bits out of key_unlink() (David Howells) [RHEL-30772] - keys: Change keyring_serialise_link_sem to a mutex (David Howells) [RHEL-30772] - wifi: brcm80211: handle pmk_op allocation failure (Jose Ignacio Tornos Martinez) [RHEL-35150] {CVE-2024-27048} - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work (Jose Ignacio Tornos Martinez) [RHEL-35140] {CVE-2024-27052} - wifi: iwlwifi: mvm: ensure offloading TID queue exists (Jose Ignacio Tornos Martinez) [RHEL-35130] {CVE-2024-27056} - wifi: mt76: mt7921e: fix use-after-free in free_irq() (Jose Ignacio Tornos Martinez) [RHEL-34866] {CVE-2024-26892} - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete (Jose Ignacio Tornos Martinez) [RHEL-34189] {CVE-2024-26897} - wifi: iwlwifi: mvm: fix a crash when we run out of stations (Jose Ignacio Tornos Martinez) [RHEL-31547] {CVE-2024-26693} - wifi: iwlwifi: fix double-free bug (Jose Ignacio Tornos Martinez) [RHEL-31543] {CVE-2024-26694} - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (Jose Ignacio Tornos Martinez) [RHEL-29089] {CVE-2023-52594} - wifi: rt2x00: restart beacon queue when hardware reset (Jose Ignacio Tornos Martinez) [RHEL-29093] {CVE-2023-52595} - wifi: iwlwifi: fix a memory corruption (Jose Ignacio Tornos Martinez) [RHEL-28903] {CVE-2024-26610} - [rt] build kernel-rt-4.18.0-553.4.1.rt7.345.el8_10 [RHEL-34640] - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117] - net/mlx5e: Prevent deadlock while disabling aRFS (Kamal Heib) [RHEL-35041] {CVE-2024-27014} - x86/tsc: Defer marking TSC unstable to a worker (Wander Lairson Costa) [RHEL-32676] - x86/smpboot: Make TSC synchronization function call based (Wander Lairson Costa) [RHEL-32676] - net: usb: fix possible use-after-free in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - net: usb: fix memory leak in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - [rt] build kernel-rt-4.18.0-552.3.1.rt7.344.el8_10 [RHEL-34640] - netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (Phil Sutter) [RHEL-30076] {CVE-2024-26643} - netfilter: nf_tables: disallow anonymous set with timeout flag (Phil Sutter) [RHEL-30080] {CVE-2024-26642} - selftests/bpf: Fix pyperf180 compilation failure with clang18 (Artem Savkov) [RHEL-35576] - md/raid5: fix atomicity violation in raid5_cache_count (Nigel Croxon) [RHEL-27930] {CVE-2024-23307} - usb: ulpi: Fix debugfs directory leak (Desnes Nunes) [RHEL-33287] {CVE-2024-26919} - powerpc/pseries: Fix potential memleak in papr_get_attr() (Mamatha Inamdar) [RHEL-35213] {CVE-2022-48669} - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (Desnes Nunes) [RHEL-35122] {CVE-2024-27059} - NFSv4: fairly test all delegations on a SEQ4_ revocation (Benjamin Coddington) [RHEL-34912] - USB: core: Fix deadlock in usb_deauthorize_interface() (Desnes Nunes) [RHEL-35002] {CVE-2024-26934} - usb: xhci: Add error handling in xhci_map_urb_for_dma (Desnes Nunes) [RHEL-34958] {CVE-2024-26964} - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (Ewan D. Milne) [RHEL-35076] {CVE-2024-26993} - xhci: handle isoc Babble and Buffer Overrun events properly (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - xhci: process isoc TD properly when there was a transaction error mid TD. (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - USB: core: Fix deadlock in port "disable" sysfs attribute (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - USB: core: Add hub_get() and hub_put() routines (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - netfilter: ipset: Missing gc cancellations fixed (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix performance regression in swap operation (Phil Sutter) [RHEL-30521] - netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test (Phil Sutter) [RHEL-30521] - x86/apic/x2apic: Fix a NULL pointer deref when handling a dying cpu (David Arcari) [RHEL-32516] - x86/coco: Disable 32-bit emulation by default on TDX and SEV (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Make IA32_EMULATION boot time configurable (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/elf: Make loading of 32bit processes depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Rename ignore_sysret() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/cpu: Don't write CSTAR MSR on Intel CPUs (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Introduce ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - [rt] build kernel-rt-4.18.0-552.2.1.rt7.343.el8_10 [RHEL-34640] - s390/ptrace: handle setting of fpc register correctly (Tobias Huschle) [RHEL-29106] {CVE-2023-52598} - net/smc: fix illegal rmb_desc access in SMC-D connection dump (Tobias Huschle) [RHEL-27746] {CVE-2024-26615} - wifi: mac80211: fix race condition on enabling fast-xmit (Jose Ignacio Tornos Martinez) [RHEL-31664] {CVE-2024-26779} - powerpc/fadump: make is_kdump_kernel() return false when fadump is active (Mamatha Inamdar) [RHEL-24401] - vmcore: remove dependency with is_kdump_kernel() for exporting vmcore (Mamatha Inamdar) [RHEL-24401] - mtd: require write permissions for locking and badblock ioctls (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - mtd: properly check all write ioctls for permissions (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - pid: take a reference when initializing `cad_pid` (Waiman Long) [RHEL-29420] {CVE-2021-47118} - i2c: i801: Don't generate an interrupt on bus reset (Prarit Bhargava) [RHEL-30325] {CVE-2021-47153} - RDMA/srpt: Do not register event handler until srpt device is fully setup (Kamal Heib) [RHEL-33224] {CVE-2024-26872} - ceph: switch to corrected encoding of max_xattr_size in mdsmap (Xiubo Li) [RHEL-26723] - ceph: switch to use cap_delay_lock for the unlink delay list (Xiubo Li) [RHEL-32870] - ceph: pass ino# instead of old_dentry if it's disconnected (Xiubo Li) [RHEL-32870] - fat: fix uninitialized field in nostale filehandles (Andrey Albershteyn) [RHEL-33186 RHEL-35108] {CVE-2024-26973} - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (Andrey Albershteyn) [RHEL-33186] {CVE-2024-26901} - idpf: limit the support to GCP only (Michal Schmidt) [RHEL-15652] - redhat/configs: enable CONFIG_IDPF (Michal Schmidt) [RHEL-15652] - idpf: remove the use of ETHTOOL_RING_USE_TCP_DATA_SPLIT (Michal Schmidt) [RHEL-15652] - idpf: workaround for unavailable skb page recycling (Michal Schmidt) [RHEL-15652] - idpf: always allocate a full page (Michal Schmidt) [RHEL-15652] - idpf: remove page pool stats code (Michal Schmidt) [RHEL-15652] - idpf: add minimal macros for __free(kfree) to work (Michal Schmidt) [RHEL-15652] - idpf: fixup include paths for RHEL 8 (Michal Schmidt) [RHEL-15652] - idpf: fix kernel panic on unknown packet types (Michal Schmidt) [RHEL-15652] - idpf: disable local BH when scheduling napi for marker packets (Michal Schmidt) [RHEL-15652] - idpf: remove dealloc vector msg err in idpf_intr_rel (Michal Schmidt) [RHEL-15652] - idpf: fix minor controlq issues (Michal Schmidt) [RHEL-15652] - idpf: prevent deinit uninitialized virtchnl core (Michal Schmidt) [RHEL-15652] - idpf: cleanup virtchnl cruft (Michal Schmidt) [RHEL-15652] - idpf: refactor idpf_recv_mb_msg (Michal Schmidt) [RHEL-15652] - idpf: add async_handler for MAC filter messages (Michal Schmidt) [RHEL-15652] - idpf: refactor remaining virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor queue related virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor vport virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: implement virtchnl transaction manager (Michal Schmidt) [RHEL-15652] - idpf: add idpf_virtchnl.h (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler padding in virtchnl2_ptype struct (Michal Schmidt) [RHEL-15652] - idpf: distinguish vports by the dev_port attribute (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler introduced padding in virtchnl2_rss_key struct (Michal Schmidt) [RHEL-15652] - idpf: fix corrupted frames and skb leaks in singleq mode (Michal Schmidt) [RHEL-15652] - idpf: refactor some missing field get/prep conversions (Michal Schmidt) [RHEL-15652] - idpf: add get/set for Ethtool's header split ringparam (Michal Schmidt) [RHEL-15652] - idpf: fix potential use-after-free in idpf_tso() (Michal Schmidt) [RHEL-15652] - idpf: cancel mailbox work in error path (Michal Schmidt) [RHEL-15652] - idpf: set scheduling mode for completion queue (Michal Schmidt) [RHEL-15652] - idpf: add SRIOV support and other ndo_ops (Michal Schmidt) [RHEL-15652] - idpf: add ethtool callbacks (Michal Schmidt) [RHEL-15652] - idpf: add singleq start_xmit and napi poll (Michal Schmidt) [RHEL-15652] - idpf: add RX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add TX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add splitq start_xmit (Michal Schmidt) [RHEL-15652] - idpf: initialize interrupts and enable vport (Michal Schmidt) [RHEL-15652] - idpf: configure resources for RX queues (Michal Schmidt) [RHEL-15652] - idpf: configure resources for TX queues (Michal Schmidt) [RHEL-15652] - idpf: add ptypes and MAC filter support (Michal Schmidt) [RHEL-15652] - idpf: add create vport and netdev configuration (Michal Schmidt) [RHEL-15652] - idpf: add core init and interrupt request (Michal Schmidt) [RHEL-15652] - idpf: add controlq init and reset checks (Michal Schmidt) [RHEL-15652] - idpf: add module register and probe functionality (Michal Schmidt) [RHEL-15652] - virtchnl: add virtchnl version 2 ops (Michal Schmidt) [RHEL-15652] - net: netdev_queue: netdev_txq_completed_mb(): fix wake condition (Michal Schmidt) [RHEL-15652] - net: piggy back on the memory barrier in bql when waking queues (Michal Schmidt) [RHEL-15652] - net: provide macros for commonly copied lockless queue stop/wake code (Michal Schmidt) [RHEL-15652] - [rt] build kernel-rt-4.18.0-552.1.1.rt7.342.el8_10 [RHEL-34640] - build: Update RTBZ for 8.10 z-stream builds (Denys Vlasenko) - redhat: set DIST to el8_10 and ZSTREAM to yes for 8.10 (Denys Vlasenko) - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (Prarit Bhargava) [RHEL-32590] {CVE-2021-47185} - net: mana: Fix Rx DMA datasize and skb_over_panic (Cathy Avery) [RHEL-32579] - RDMA/srpt: Support specifying the srpt_service_guid parameter (Kamal Heib) [RHEL-31710] {CVE-2024-26744} - RDMA/qedr: Fix qedr_create_user_qp error flow (Kamal Heib) [RHEL-31714] {CVE-2024-26743} - hwmon: (coretemp) Fix out-of-bounds memory access (David Arcari) [RHEL-31305] {CVE-2024-26664} - RDMA/irdma: Fix KASAN issue with tasklet (Kamal Heib) [RHEL-15776] - net: bridge: use DEV_STATS_INC() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: Fix unwanted sign extension in netdev_stats_to_stats64() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: add atomic_long_t to net_device_stats fields (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net/sched: act_ct: fix skb leak and crash on ooo frags (Xin Long) [RHEL-29467] {CVE-2023-52610} - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Jose Ignacio Tornos Martinez) [RHEL-28015] {CVE-2023-52528} - RDMA/core: Fix uninit-value access in ib_get_eth_speed() (Kamal Heib) [RHEL-30130] - RDMA/core: Get IB width and speed from netdev (Kamal Heib) [RHEL-30130] - cpufreq: intel_pstate: Add Emerald Rapids support in no-HWP mode (Prarit Bhargava) [RHEL-29444] - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add (Mamatha Inamdar) [RHEL-29118] {CVE-2023-52607} - powerpc/lib: Validate size for vector operations (Mamatha Inamdar) [RHEL-29114] {CVE-2023-52606} - usb: hub: Guard against accesses to uninitialized BOS descriptors (Desnes Nunes) [RHEL-28986] {CVE-2023-52477} - media: uvcvideo: Fix OOB read (Desnes Nunes) [RHEL-27940] {CVE-2023-52565} - media: pvrusb2: fix use after free on context disconnection (Desnes Nunes) [RHEL-26498] {CVE-2023-52445} - i2c: i801: Fix block process call transactions (Prarit Bhargava) [RHEL-26478] {CVE-2024-26593} - overlay: disable EVM (Coiby Xu) [RHEL-19863] - evm: add support to disable EVM on unsupported filesystems (Coiby Xu) [RHEL-19863] - evm: don't copy up 'security.evm' xattr (Coiby Xu) [RHEL-19863] - net: ena: Remove ena_select_queue (Kamal Heib) [RHEL-14286] - media: dvbdev: Fix memory leak in dvb_media_device_free() (Prarit Bhargava) [RHEL-27254] {CVE-2020-36777} - gfs2: Fix invalid metadata access in punch_hole (Andrew Price) [RHEL-28784] - i2c: Fix a potential use after free (Prarit Bhargava) [RHEL-26849] {CVE-2019-25162} - i2c: validate user data in compat ioctl (Prarit Bhargava) [RHEL-27022] {CVE-2021-46934} - platform/x86: think-lmi: Fix reference leak (Prarit Bhargava) [RHEL-28030] {CVE-2023-52520} - vhost: use kzalloc() instead of kmalloc() followed by memset() (Jon Maloy) [RHEL-21505] {CVE-2024-0340} - RDMA/siw: Fix connection failure handling (Kamal Heib) [RHEL-28042] {CVE-2023-52513} - vt: fix memory overlapping when deleting chars in the buffer (Waiman Long) [RHEL-27778 RHEL-27779] {CVE-2022-48627} - x86/fpu: Stop relying on userspace for info to fault in xsave buffer (Steve Best) [RHEL-26669] {CVE-2024-26603} - mptcp: fix double-free on socket dismantle (Davide Caratti) [RHEL-22773] {CVE-2024-26782} - crypto: akcipher - Disable signing and decryption (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: akcipher - default implementations for request callbacks (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: testmgr - split akcipher tests by a key type (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - workqueue: Warn when a rescuer could not be created (Waiman Long) [RHEL-22136] - RDMA/cma: Avoid GID lookups on iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/cma: Deduplicate error flow in cma_validate_port() (Benjamin Coddington) [RHEL-12456] - RDMA/core: Set gid_attr.ndev for iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/siw: Fabricate a GID on tun and loopback devices (Benjamin Coddington) [RHEL-12456] - eventpoll: fix missing wakeup for ovflist in ep_poll_callback (Luis Claudio R. Goncalves) [RHEL-23022] - [rt] build kernel-rt-4.18.0-552.rt7.341.el8 [RHEL-5332] - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248] - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248] - [rt] build kernel-rt-4.18.0-551.rt7.340.el8 [RHEL-5332] - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742} - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992] - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992] - [rt] build kernel-rt-4.18.0-550.rt7.339.el8 [RHEL-5332] - mm/sparsemem: fix race in accessing memory_section->usage (Waiman Long) [RHEL-28875 RHEL-28876] {CVE-2023-52489} - mm: use __pfn_to_section() instead of open coding it (Waiman Long) [RHEL-28875] {CVE-2023-52489} - [rt] build kernel-rt-4.18.0-549.rt7.338.el8 [RHEL-5332] - dm-integrity: align the outgoing bio in integrity_recheck (Benjamin Marzinski) [RHEL-29678] - dm-integrity: fix a memory leak when rechecking the data (Benjamin Marzinski) [RHEL-29678] - RDMA/mana_ib: Add CQ interrupt support for RAW QP (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: query device capabilities (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: register RDMA device with GDMA (Maxim Levitsky) [RHEL-23934] - net: mana: add msix index sharing between EQs (Maxim Levitsky) [RHEL-23934] - net: mana: Fix spelling mistake "enforecement" -> "enforcement" (Maxim Levitsky) [RHEL-23934] - net :mana :Add remaining GDMA stats for MANA to ethtool (Maxim Levitsky) [RHEL-23934] - net: mana: Fix oversized sge0 for GSO packets (Maxim Levitsky) [RHEL-23934] - net: mana: Fix TX CQE error handling (Maxim Levitsky) [RHEL-23934] - net: mana: Add gdma stats to ethtool output for mana (Maxim Levitsky) [RHEL-23934] - net: mana: Fix MANA VF unload when hardware is unresponsive (Maxim Levitsky) [RHEL-23934] - net: mana: Configure hwc timeout from hardware (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (Maxim Levitsky) [RHEL-23934] - [rt] build kernel-rt-4.18.0-548.rt7.337.el8 [RHEL-5332] - gitlab-ci: enable arm64/s390x/ppc64le debug builds (Michael Hofmann) - arm64: Add missing bits of AmpereOne Spectre-BHB mitigation (Mark Salter) [RHEL-29005] - [rt] enable CONFIG_DRM_MGAG200_IOBURST_WORKAROUND (Jocelyn Falempe) [RHEL-13214] - drm/mgag200: Add a workaround for low-latency (Jocelyn Falempe) [RHEL-13214] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - [rt] build kernel-rt-4.18.0-553.8.1.rt7.349.el8_10 [RHEL-40882] - udf: Fix NULL pointer dereference in udf_symlink function (Pavel Reichl) [RHEL-37769] {CVE-2021-47353} - net: ti: fix UAF in tlan_remove_one (Jose Ignacio Tornos Martinez) [RHEL-38940] {CVE-2021-47310} - ARM: footbridge: fix PCI interrupt mapping (Myron Stowe) [RHEL-26971] {CVE-2021-46909} - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (Kamal Heib) [RHEL-37454] {CVE-2024-36004} - net/mlx5e: Fix mlx5e_priv_init() cleanup flow (Kamal Heib) [RHEL-37424] {CVE-2024-35959} - net/mlx5: Properly link new fs rules into the tree (Kamal Heib) [RHEL-37420] {CVE-2024-35960} - net/mlx5e: fix a potential double-free in fs_any_create_groups (Kamal Heib) [RHEL-37091] {CVE-2023-52667} - net: ena: Fix incorrect descriptor free behavior (Kamal Heib) [RHEL-37428] {CVE-2024-35958} - mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - mISDN: fix possible use-after-free in HFC_cleanup() (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - implement dh fallback for primes > 4K (Vladis Dronov) [RHEL-35106] - crypto: qat - avoid division by zero (Vladis Dronov) [RHEL-35106] - crypto: qat - resolve race condition during AER recovery (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - use kcalloc_node() instead of kzalloc_node() (Vladis Dronov) [RHEL-35106] - [rt] Enable CONFIG_DRM_MGAG200_DISABLE_WRITECOMBINE (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Add an option to disable Write-Combine (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Fix caching setup for remapped video memory (Jocelyn Falempe) [RHEL-36172] - Revert "drm/mgag200: Add a workaround for low-latency" (Jocelyn Falempe) [RHEL-36172] - mptcp: fix data re-injection from stale subflow (Davide Caratti) [RHEL-33133] {CVE-2024-26826} - ipv6: sr: fix incorrect unregister order (Hangbin Liu) [RHEL-31730] - ipv6: sr: fix possible use-after-free and null-ptr-deref (Hangbin Liu) [RHEL-31730] {CVE-2024-26735} - net/bnx2x: Prevent access to a freed page in page_pool (Michal Schmidt) [RHEL-14195 RHEL-33243] {CVE-2024-26859} - bnx2x: new flag for track HW resource allocation (Michal Schmidt) [RHEL-14195 RHEL-33243] - bnx2x: fix page fault following EEH recovery (Michal Schmidt) [RHEL-14195 RHEL-33243] - x86: KVM: SVM: always update the x2avic msr interception (Maxim Levitsky) [RHEL-15495] {CVE-2023-5090} - EDAC/thunderx: Fix possible out-of-bounds string access (Aristeu Rozanski) [RHEL-26573] {CVE-2023-52464} - [rt] build kernel-rt-4.18.0-553.7.1.rt7.348.el8_10 [RHEL-34640] - net: qcom/emac: fix UAF in emac_remove (Ken Cox) [RHEL-37834] {CVE-2021-47311} - perf/core: Bail out early if the request AUX area is out of bound (Michael Petlan) [RHEL-38268] {CVE-2023-52835} - crypto: pcrypt - Fix hungtask for PADATA_RESET (Herbert Xu) [RHEL-38171] {CVE-2023-52813} - drm/amdgpu: fix use-after-free bug (Jocelyn Falempe) [RHEL-31240] {CVE-2024-26656} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash (Ivan Vecera) [RHEL-37008] {CVE-2024-35854} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update (Ivan Vecera) [RHEL-37004] {CVE-2024-35855} - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (Ivan Vecera) [RHEL-37012] {CVE-2024-35853} - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work (Ivan Vecera) [RHEL-37016] {CVE-2024-35852} - mlxsw: spectrum_acl_tcam: Fix warning during rehash (Ivan Vecera) [RHEL-37480] {CVE-2024-36007} - can: peak_pci: peak_pci_remove(): fix UAF (Jose Ignacio Tornos Martinez) [RHEL-38419] {CVE-2021-47456} - usbnet: fix error return code in usbnet_probe() (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - usbnet: sanity check for maxpacket (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - net/mlx5e: fix a double-free in arfs_create_groups (Kamal Heib) [RHEL-36920] {CVE-2024-35835} - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds (Jose Ignacio Tornos Martinez) [RHEL-38220] {CVE-2023-52878} - net: cdc_eem: fix tx fixup skb leak (Jose Ignacio Tornos Martinez) [RHEL-38080] {CVE-2021-47236} - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Jose Ignacio Tornos Martinez) [RHEL-38113] {CVE-2023-52703} - usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() (Desnes Nunes) [RHEL-38248] {CVE-2023-52877} - usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (Desnes Nunes) [RHEL-38240] {CVE-2023-52781} - gro: fix ownership transfer (Xin Long) [RHEL-37226] {CVE-2024-35890} - tipc: fix kernel warning when sending SYN message (Xin Long) [RHEL-38109] {CVE-2023-52700} - erspan: make sure erspan_base_hdr is present in skb->head (Xin Long) [RHEL-37230] {CVE-2024-35888} - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() (Bryan Gurney) [RHEL-17366] - scsi: mpi3mr: Sanitise num_phys (Bryan Gurney) [RHEL-17366] - netfilter: nf_tables: use timestamp to check for set element timeout (Phil Sutter) [RHEL-38023] {CVE-2024-27397} - net/ipv6: SKB symmetric hash should incorporate transport ports (Sabrina Dubroca) [RHEL-32061] - crypto: s390/aes - Fix buffer overread in CTR mode (Herbert Xu) [RHEL-37089] {CVE-2023-52669} - net: Save and restore msg_namelen in sock_sendmsg (Jamie Bainbridge) [RHEL-35893] - net: prevent address rewrite in kernel_bind() (Jamie Bainbridge) [RHEL-35893] - net: prevent rewrite of msg_name in sock_sendmsg() (Jamie Bainbridge) [RHEL-35893] - net: replace calls to sock->ops->connect() with kernel_connect() (Jamie Bainbridge) [RHEL-35893] - net: Avoid address overwrite in kernel_connect (Jamie Bainbridge) [RHEL-35893] - wifi: iwlwifi: dbg-tlv: ensure NUL termination (Jose Ignacio Tornos Martinez) [RHEL-37026] {CVE-2024-35845} - wifi: mac80211: fix potential sta-link leak (Jose Ignacio Tornos Martinez) [RHEL-36916] {CVE-2024-35838} - wifi: nl80211: reject iftype change with mesh ID change (Jose Ignacio Tornos Martinez) [RHEL-36884] {CVE-2024-27410} - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (Jose Ignacio Tornos Martinez) [RHEL-36807] {CVE-2024-35789} - Bluetooth: Avoid potential use-after-free in hci_error_reset (David Marlin) [RHEL-31826] {CVE-2024-26801} - tls: disable async encrypt/decrypt (Sabrina Dubroca) [RHEL-26362 RHEL-26409 RHEL-26420] {CVE-2024-26585 CVE-2024-26583 CVE-2024-26584} - Squashfs: check the inode number is not the invalid value of zero (Phillip Lougher) [RHEL-35096] {CVE-2024-26982} - ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/msg.c: update and document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/sem.c: document and update memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: update/document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: remove duplicated code (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (Kamal Heib) [RHEL-30582] {CVE-2023-52626} - Revert "ACPI: bus: Rework system-level device notification handling" (Prarit Bhargava) [RHEL-21486] - hwrng: core - Fix page fault dead lock on mmap-ed hwrng (Prarit Bhargava) [RHEL-29485] {CVE-2023-52615} - [rt] build kernel-rt-4.18.0-553.6.1.rt7.347.el8_10 [RHEL-34640] - cxgb4: Properly lock TX queue for the selftest. (John B. Wyatt IV) [RHEL-8779] - powerpc/powernv: Add a null pointer check in opal_event_init() (Mamatha Inamdar) [RHEL-37058] {CVE-2023-52686} - crypto: rsa - add a check for allocation failure (Vladis Dronov) [RHEL-35361] - crypto: rsa - allow only odd e and restrict value in FIPS mode (Vladis Dronov) [RHEL-35361] - KEYS: use kfree_sensitive with key (Vladis Dronov) [RHEL-35361] - lib/mpi: Extend the MPI library (only mpi_*_bit() part) (Vladis Dronov) [RHEL-35361] - net: ip_tunnel: prevent perpetual headroom growth (Felix Maurer) [RHEL-31814] {CVE-2024-26804} - s390/cpum_cf: make crypto counters upward compatible across machine types (Tobias Huschle) [RHEL-36048] - RDMA/mlx5: Fix fortify source warning while accessing Eth segment (Kamal Heib) [RHEL-33162] {CVE-2024-26907} - ovl: fix leaked dentry (Miklos Szeredi) [RHEL-27306] {CVE-2021-46972} - x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - x86/mm/vsyscall: Consider vsyscall page part of user address space (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - x86/mm: Add vsyscall address helper (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - mm/swap: fix race when skipping swapcache (Rafael Aquini) [RHEL-31644] {CVE-2024-26759} - swap: fix do_swap_page() race with swapoff (Rafael Aquini) [RHEL-31644] {CVE-2024-26759} - mm/swapfile: use percpu_ref to serialize against concurrent swapoff (Rafael Aquini) [RHEL-31644] {CVE-2024-26759} - mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions() (Rafael Aquini) [RHEL-29294] {CVE-2023-52560} - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr (Jiri Benc) [RHEL-29783] - block: null_blk: Fix handling of fake timeout request (Ming Lei) [RHEL-8130] - null_blk: fix poll request timeout handling (Ming Lei) [RHEL-8130] - block: null_blk: end timed out poll request (Ming Lei) [RHEL-8130] - block: null_blk: only set set->nr_maps as 3 if active poll_queues is > 0 (Ming Lei) [RHEL-8130] - null_blk: allow zero poll queues (Ming Lei) [RHEL-8130] - null_blk: Fix handling of submit_queues and poll_queues attributes (Ming Lei) [RHEL-8130] - null_blk: poll queue support (Ming Lei) [RHEL-8130] - null_blk: fix command timeout completion handling (Ming Lei) [RHEL-8130] - platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (Prarit Bhargava) [RHEL-27790] {CVE-2021-47073} - Bluetooth: avoid memcmp() out of bounds warning (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: hci_event: Fix coding style (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: hci_event: Fix using memcmp when comparing keys (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: Reject connection with the device which has same BD_ADDR (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: hci_event: Ignore NULL link key (David Marlin) [RHEL-3017] {CVE-2020-26555} - ppp_async: limit MRU to 64K (Guillaume Nault) [RHEL-31353] {CVE-2024-26675} - powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (Mamatha Inamdar) [RHEL-37078] {CVE-2023-52675} - tcp: do not accept ACK of bytes we never sent (Xin Long) [RHEL-21952] - [rt] build kernel-rt-4.18.0-553.5.1.rt7.346.el8_10 [RHEL-34640] - tools/power/turbostat: Fix uncore frequency file string (David Arcari) [RHEL-29238] - tools/power turbostat: Expand probe_intel_uncore_frequency() (David Arcari) [RHEL-29238] - uio: Fix use-after-free in uio_open (Ricardo Robaina) [RHEL-26232] {CVE-2023-52439} - net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (Ken Cox) [RHEL-27316] {CVE-2021-47013} - keys: Fix linking a duplicate key to a keyring's assoc_array (David Howells) [RHEL-30772] - keys: Hoist locking out of __key_link_begin() (David Howells) [RHEL-30772] - keys: Break bits out of key_unlink() (David Howells) [RHEL-30772] - keys: Change keyring_serialise_link_sem to a mutex (David Howells) [RHEL-30772] - wifi: brcm80211: handle pmk_op allocation failure (Jose Ignacio Tornos Martinez) [RHEL-35150] {CVE-2024-27048} - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work (Jose Ignacio Tornos Martinez) [RHEL-35140] {CVE-2024-27052} - wifi: iwlwifi: mvm: ensure offloading TID queue exists (Jose Ignacio Tornos Martinez) [RHEL-35130] {CVE-2024-27056} - wifi: mt76: mt7921e: fix use-after-free in free_irq() (Jose Ignacio Tornos Martinez) [RHEL-34866] {CVE-2024-26892} - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete (Jose Ignacio Tornos Martinez) [RHEL-34189] {CVE-2024-26897} - wifi: iwlwifi: mvm: fix a crash when we run out of stations (Jose Ignacio Tornos Martinez) [RHEL-31547] {CVE-2024-26693} - wifi: iwlwifi: fix double-free bug (Jose Ignacio Tornos Martinez) [RHEL-31543] {CVE-2024-26694} - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (Jose Ignacio Tornos Martinez) [RHEL-29089] {CVE-2023-52594} - wifi: rt2x00: restart beacon queue when hardware reset (Jose Ignacio Tornos Martinez) [RHEL-29093] {CVE-2023-52595} - wifi: iwlwifi: fix a memory corruption (Jose Ignacio Tornos Martinez) [RHEL-28903] {CVE-2024-26610} - [rt] build kernel-rt-4.18.0-553.4.1.rt7.345.el8_10 [RHEL-34640] - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117] - net/mlx5e: Prevent deadlock while disabling aRFS (Kamal Heib) [RHEL-35041] {CVE-2024-27014} - x86/tsc: Defer marking TSC unstable to a worker (Wander Lairson Costa) [RHEL-32676] - x86/smpboot: Make TSC synchronization function call based (Wander Lairson Costa) [RHEL-32676] - net: usb: fix possible use-after-free in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - net: usb: fix memory leak in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - [rt] build kernel-rt-4.18.0-552.3.1.rt7.344.el8_10 [RHEL-34640] - netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (Phil Sutter) [RHEL-30076] {CVE-2024-26643} - netfilter: nf_tables: disallow anonymous set with timeout flag (Phil Sutter) [RHEL-30080] {CVE-2024-26642} - selftests/bpf: Fix pyperf180 compilation failure with clang18 (Artem Savkov) [RHEL-35576] - md/raid5: fix atomicity violation in raid5_cache_count (Nigel Croxon) [RHEL-27930] {CVE-2024-23307} - usb: ulpi: Fix debugfs directory leak (Desnes Nunes) [RHEL-33287] {CVE-2024-26919} - powerpc/pseries: Fix potential memleak in papr_get_attr() (Mamatha Inamdar) [RHEL-35213] {CVE-2022-48669} - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (Desnes Nunes) [RHEL-35122] {CVE-2024-27059} - NFSv4: fairly test all delegations on a SEQ4_ revocation (Benjamin Coddington) [RHEL-34912] - USB: core: Fix deadlock in usb_deauthorize_interface() (Desnes Nunes) [RHEL-35002] {CVE-2024-26934} - usb: xhci: Add error handling in xhci_map_urb_for_dma (Desnes Nunes) [RHEL-34958] {CVE-2024-26964} - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (Ewan D. Milne) [RHEL-35076] {CVE-2024-26993} - xhci: handle isoc Babble and Buffer Overrun events properly (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - xhci: process isoc TD properly when there was a transaction error mid TD. (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - USB: core: Fix deadlock in port "disable" sysfs attribute (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - USB: core: Add hub_get() and hub_put() routines (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - netfilter: ipset: Missing gc cancellations fixed (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix performance regression in swap operation (Phil Sutter) [RHEL-30521] - netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test (Phil Sutter) [RHEL-30521] - x86/apic/x2apic: Fix a NULL pointer deref when handling a dying cpu (David Arcari) [RHEL-32516] - x86/coco: Disable 32-bit emulation by default on TDX and SEV (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Make IA32_EMULATION boot time configurable (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/elf: Make loading of 32bit processes depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Rename ignore_sysret() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/cpu: Don't write CSTAR MSR on Intel CPUs (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Introduce ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - [rt] build kernel-rt-4.18.0-552.2.1.rt7.343.el8_10 [RHEL-34640] - s390/ptrace: handle setting of fpc register correctly (Tobias Huschle) [RHEL-29106] {CVE-2023-52598} - net/smc: fix illegal rmb_desc access in SMC-D connection dump (Tobias Huschle) [RHEL-27746] {CVE-2024-26615} - wifi: mac80211: fix race condition on enabling fast-xmit (Jose Ignacio Tornos Martinez) [RHEL-31664] {CVE-2024-26779} - powerpc/fadump: make is_kdump_kernel() return false when fadump is active (Mamatha Inamdar) [RHEL-24401] - vmcore: remove dependency with is_kdump_kernel() for exporting vmcore (Mamatha Inamdar) [RHEL-24401] - mtd: require write permissions for locking and badblock ioctls (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - mtd: properly check all write ioctls for permissions (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - pid: take a reference when initializing `cad_pid` (Waiman Long) [RHEL-29420] {CVE-2021-47118} - i2c: i801: Don't generate an interrupt on bus reset (Prarit Bhargava) [RHEL-30325] {CVE-2021-47153} - RDMA/srpt: Do not register event handler until srpt device is fully setup (Kamal Heib) [RHEL-33224] {CVE-2024-26872} - ceph: switch to corrected encoding of max_xattr_size in mdsmap (Xiubo Li) [RHEL-26723] - ceph: switch to use cap_delay_lock for the unlink delay list (Xiubo Li) [RHEL-32870] - ceph: pass ino# instead of old_dentry if it's disconnected (Xiubo Li) [RHEL-32870] - fat: fix uninitialized field in nostale filehandles (Andrey Albershteyn) [RHEL-33186 RHEL-35108] {CVE-2024-26973} - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (Andrey Albershteyn) [RHEL-33186] {CVE-2024-26901} - idpf: limit the support to GCP only (Michal Schmidt) [RHEL-15652] - redhat/configs: enable CONFIG_IDPF (Michal Schmidt) [RHEL-15652] - idpf: remove the use of ETHTOOL_RING_USE_TCP_DATA_SPLIT (Michal Schmidt) [RHEL-15652] - idpf: workaround for unavailable skb page recycling (Michal Schmidt) [RHEL-15652] - idpf: always allocate a full page (Michal Schmidt) [RHEL-15652] - idpf: remove page pool stats code (Michal Schmidt) [RHEL-15652] - idpf: add minimal macros for __free(kfree) to work (Michal Schmidt) [RHEL-15652] - idpf: fixup include paths for RHEL 8 (Michal Schmidt) [RHEL-15652] - idpf: fix kernel panic on unknown packet types (Michal Schmidt) [RHEL-15652] - idpf: disable local BH when scheduling napi for marker packets (Michal Schmidt) [RHEL-15652] - idpf: remove dealloc vector msg err in idpf_intr_rel (Michal Schmidt) [RHEL-15652] - idpf: fix minor controlq issues (Michal Schmidt) [RHEL-15652] - idpf: prevent deinit uninitialized virtchnl core (Michal Schmidt) [RHEL-15652] - idpf: cleanup virtchnl cruft (Michal Schmidt) [RHEL-15652] - idpf: refactor idpf_recv_mb_msg (Michal Schmidt) [RHEL-15652] - idpf: add async_handler for MAC filter messages (Michal Schmidt) [RHEL-15652] - idpf: refactor remaining virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor queue related virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor vport virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: implement virtchnl transaction manager (Michal Schmidt) [RHEL-15652] - idpf: add idpf_virtchnl.h (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler padding in virtchnl2_ptype struct (Michal Schmidt) [RHEL-15652] - idpf: distinguish vports by the dev_port attribute (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler introduced padding in virtchnl2_rss_key struct (Michal Schmidt) [RHEL-15652] - idpf: fix corrupted frames and skb leaks in singleq mode (Michal Schmidt) [RHEL-15652] - idpf: refactor some missing field get/prep conversions (Michal Schmidt) [RHEL-15652] - idpf: add get/set for Ethtool's header split ringparam (Michal Schmidt) [RHEL-15652] - idpf: fix potential use-after-free in idpf_tso() (Michal Schmidt) [RHEL-15652] - idpf: cancel mailbox work in error path (Michal Schmidt) [RHEL-15652] - idpf: set scheduling mode for completion queue (Michal Schmidt) [RHEL-15652] - idpf: add SRIOV support and other ndo_ops (Michal Schmidt) [RHEL-15652] - idpf: add ethtool callbacks (Michal Schmidt) [RHEL-15652] - idpf: add singleq start_xmit and napi poll (Michal Schmidt) [RHEL-15652] - idpf: add RX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add TX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add splitq start_xmit (Michal Schmidt) [RHEL-15652] - idpf: initialize interrupts and enable vport (Michal Schmidt) [RHEL-15652] - idpf: configure resources for RX queues (Michal Schmidt) [RHEL-15652] - idpf: configure resources for TX queues (Michal Schmidt) [RHEL-15652] - idpf: add ptypes and MAC filter support (Michal Schmidt) [RHEL-15652] - idpf: add create vport and netdev configuration (Michal Schmidt) [RHEL-15652] - idpf: add core init and interrupt request (Michal Schmidt) [RHEL-15652] - idpf: add controlq init and reset checks (Michal Schmidt) [RHEL-15652] - idpf: add module register and probe functionality (Michal Schmidt) [RHEL-15652] - virtchnl: add virtchnl version 2 ops (Michal Schmidt) [RHEL-15652] - net: netdev_queue: netdev_txq_completed_mb(): fix wake condition (Michal Schmidt) [RHEL-15652] - net: piggy back on the memory barrier in bql when waking queues (Michal Schmidt) [RHEL-15652] - net: provide macros for commonly copied lockless queue stop/wake code (Michal Schmidt) [RHEL-15652] - [rt] build kernel-rt-4.18.0-552.1.1.rt7.342.el8_10 [RHEL-34640] - build: Update RTBZ for 8.10 z-stream builds (Denys Vlasenko) - redhat: set DIST to el8_10 and ZSTREAM to yes for 8.10 (Denys Vlasenko) - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (Prarit Bhargava) [RHEL-32590] {CVE-2021-47185} - net: mana: Fix Rx DMA datasize and skb_over_panic (Cathy Avery) [RHEL-32579] - RDMA/srpt: Support specifying the srpt_service_guid parameter (Kamal Heib) [RHEL-31710] {CVE-2024-26744} - RDMA/qedr: Fix qedr_create_user_qp error flow (Kamal Heib) [RHEL-31714] {CVE-2024-26743} - hwmon: (coretemp) Fix out-of-bounds memory access (David Arcari) [RHEL-31305] {CVE-2024-26664} - RDMA/irdma: Fix KASAN issue with tasklet (Kamal Heib) [RHEL-15776] - net: bridge: use DEV_STATS_INC() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: Fix unwanted sign extension in netdev_stats_to_stats64() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: add atomic_long_t to net_device_stats fields (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net/sched: act_ct: fix skb leak and crash on ooo frags (Xin Long) [RHEL-29467] {CVE-2023-52610} - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Jose Ignacio Tornos Martinez) [RHEL-28015] {CVE-2023-52528} - RDMA/core: Fix uninit-value access in ib_get_eth_speed() (Kamal Heib) [RHEL-30130] - RDMA/core: Get IB width and speed from netdev (Kamal Heib) [RHEL-30130] - cpufreq: intel_pstate: Add Emerald Rapids support in no-HWP mode (Prarit Bhargava) [RHEL-29444] - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add (Mamatha Inamdar) [RHEL-29118] {CVE-2023-52607} - powerpc/lib: Validate size for vector operations (Mamatha Inamdar) [RHEL-29114] {CVE-2023-52606} - usb: hub: Guard against accesses to uninitialized BOS descriptors (Desnes Nunes) [RHEL-28986] {CVE-2023-52477} - media: uvcvideo: Fix OOB read (Desnes Nunes) [RHEL-27940] {CVE-2023-52565} - media: pvrusb2: fix use after free on context disconnection (Desnes Nunes) [RHEL-26498] {CVE-2023-52445} - i2c: i801: Fix block process call transactions (Prarit Bhargava) [RHEL-26478] {CVE-2024-26593} - overlay: disable EVM (Coiby Xu) [RHEL-19863] - evm: add support to disable EVM on unsupported filesystems (Coiby Xu) [RHEL-19863] - evm: don't copy up 'security.evm' xattr (Coiby Xu) [RHEL-19863] - net: ena: Remove ena_select_queue (Kamal Heib) [RHEL-14286] - media: dvbdev: Fix memory leak in dvb_media_device_free() (Prarit Bhargava) [RHEL-27254] {CVE-2020-36777} - gfs2: Fix invalid metadata access in punch_hole (Andrew Price) [RHEL-28784] - i2c: Fix a potential use after free (Prarit Bhargava) [RHEL-26849] {CVE-2019-25162} - i2c: validate user data in compat ioctl (Prarit Bhargava) [RHEL-27022] {CVE-2021-46934} - platform/x86: think-lmi: Fix reference leak (Prarit Bhargava) [RHEL-28030] {CVE-2023-52520} - vhost: use kzalloc() instead of kmalloc() followed by memset() (Jon Maloy) [RHEL-21505] {CVE-2024-0340} - RDMA/siw: Fix connection failure handling (Kamal Heib) [RHEL-28042] {CVE-2023-52513} - vt: fix memory overlapping when deleting chars in the buffer (Waiman Long) [RHEL-27778 RHEL-27779] {CVE-2022-48627} - x86/fpu: Stop relying on userspace for info to fault in xsave buffer (Steve Best) [RHEL-26669] {CVE-2024-26603} - mptcp: fix double-free on socket dismantle (Davide Caratti) [RHEL-22773] {CVE-2024-26782} - crypto: akcipher - Disable signing and decryption (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: akcipher - default implementations for request callbacks (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: testmgr - split akcipher tests by a key type (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - workqueue: Warn when a rescuer could not be created (Waiman Long) [RHEL-22136] - RDMA/cma: Avoid GID lookups on iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/cma: Deduplicate error flow in cma_validate_port() (Benjamin Coddington) [RHEL-12456] - RDMA/core: Set gid_attr.ndev for iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/siw: Fabricate a GID on tun and loopback devices (Benjamin Coddington) [RHEL-12456] - eventpoll: fix missing wakeup for ovflist in ep_poll_callback (Luis Claudio R. Goncalves) [RHEL-23022] - [rt] build kernel-rt-4.18.0-552.rt7.341.el8 [RHEL-5332] - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248] - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248] - [rt] build kernel-rt-4.18.0-551.rt7.340.el8 [RHEL-5332] - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742} - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992] - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825} - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237] - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724} - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513} - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921] - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921] - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921] - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921] - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921] - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774] - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660] - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660] - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199] - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539} - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825} - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237] - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724} - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513} - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921] - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921] - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921] - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921] - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921] - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285} - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993} - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396] - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396] - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396] - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396] - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355] - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355] - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355] - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355] - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355] - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355] - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240} - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek) - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963] - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171] - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171] - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226] - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226] - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744] - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744] - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744] - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744] - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew) [RHEL-129945] - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774] - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660] - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660] - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199] - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539} - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825} - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237] - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724} - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513} - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921] - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921] - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921] - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921] - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921] - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301} - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933} - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051} - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449] - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096} - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285} - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993} - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396] - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396] - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396] - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396] - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355] - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355] - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355] - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355] - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355] - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355] - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240} - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek) - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963] - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171] - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171] - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226] - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226] - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744] - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744] - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744] - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744] - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew) [RHEL-129945] - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774] - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660] - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660] - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199] - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539} - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - Bluetooth: hci_event: call disconnect callback before deleting conn (CKI Backport Bot) [RHEL-137039] {CVE-2023-53673} - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CKI Backport Bot) [RHEL-134423] {CVE-2025-40277} - xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 (John J Coleman) [RHEL-111354] - xen: Fix x86 sched_clock() interface for xen (John J Coleman) [RHEL-111354] - x86/xen/time: Output xen sched_clock time from 0 (John J Coleman) [RHEL-111354] - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Olga Kornievskaia) [RHEL-132819] - vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139273] {CVE-2025-40248} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ignore ndlp rport mismatch in dev_loss_tmo callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Modify handling of ADISC based on ndlp state and RPI registration (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Delete NLP_TARGET_REMOVE flag due to obsolete usage (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo callback (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Check devloss callbk done flag for potential stale NDLP ptrs (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kref imbalance on fabric ndlps from dev_loss_tmo handler (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Update PRLO handling in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Add condition to delete ndlp object after sending BLS_RJT to an ABTS (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove NLP_RCV_PLOGI early return during RSCN processing for ndlps (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Allow lpfc_plogi_confirm_nport() logic to execute for Fabric nodes (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix list_entry null check warning in lpfc_cmpl_els_plogi() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix possible file string name overflow when updating firmware (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Validate ELS LS_ACC completion payload (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove extra ndlp kref decrement in FLOGI cmpl for loop topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Revise NPIV ELS unsol rcv cmpl logic to drop ndlp based on nlp_state (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix double free in lpfc_cmpl_els_logo_acc() caused by lpfc_nlp_not_used() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Move scsi_host_template outside dynamically allocated/freed phba (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fill in missing ndlp kref puts in error paths (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login (Ewan D. Milne) [RHEL-32324] - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301} - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933} - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051} - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449] - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096} - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285} - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993} - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396] - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396] - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396] - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396] - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355] - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355] - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355] - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355] - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355] - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355] - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240} - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek) - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963] - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171] - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171] - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226] - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226] - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744] - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744] - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744] - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744] - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew) [RHEL-129945] - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117] - [rt] build kernel-rt-4.18.0-552.rt7.341.el8 [RHEL-5332] - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248] - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248] - [rt] build kernel-rt-4.18.0-551.rt7.340.el8 [RHEL-5332] - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742} - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992] - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992] - [rt] build kernel-rt-4.18.0-550.rt7.339.el8 [RHEL-5332] - mm/sparsemem: fix race in accessing memory_section->usage (Waiman Long) [RHEL-28875 RHEL-28876] {CVE-2023-52489} - mm: use __pfn_to_section() instead of open coding it (Waiman Long) [RHEL-28875] {CVE-2023-52489} - [rt] build kernel-rt-4.18.0-549.rt7.338.el8 [RHEL-5332] - dm-integrity: align the outgoing bio in integrity_recheck (Benjamin Marzinski) [RHEL-29678] - dm-integrity: fix a memory leak when rechecking the data (Benjamin Marzinski) [RHEL-29678] - RDMA/mana_ib: Add CQ interrupt support for RAW QP (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: query device capabilities (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: register RDMA device with GDMA (Maxim Levitsky) [RHEL-23934] - net: mana: add msix index sharing between EQs (Maxim Levitsky) [RHEL-23934] - net: mana: Fix spelling mistake "enforecement" -> "enforcement" (Maxim Levitsky) [RHEL-23934] - net :mana :Add remaining GDMA stats for MANA to ethtool (Maxim Levitsky) [RHEL-23934] - net: mana: Fix oversized sge0 for GSO packets (Maxim Levitsky) [RHEL-23934] - net: mana: Fix TX CQE error handling (Maxim Levitsky) [RHEL-23934] - net: mana: Add gdma stats to ethtool output for mana (Maxim Levitsky) [RHEL-23934] - net: mana: Fix MANA VF unload when hardware is unresponsive (Maxim Levitsky) [RHEL-23934] - net: mana: Configure hwc timeout from hardware (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (Maxim Levitsky) [RHEL-23934] - [rt] build kernel-rt-4.18.0-548.rt7.337.el8 [RHEL-5332] - gitlab-ci: enable arm64/s390x/ppc64le debug builds (Michael Hofmann) - arm64: Add missing bits of AmpereOne Spectre-BHB mitigation (Mark Salter) [RHEL-29005] - [rt] enable CONFIG_DRM_MGAG200_IOBURST_WORKAROUND (Jocelyn Falempe) [RHEL-13214] - drm/mgag200: Add a workaround for low-latency (Jocelyn Falempe) [RHEL-13214] - [rt] build kernel-rt-4.18.0-547.rt7.336.el8 [RHEL-5332] - x86/efistub: Avoid placing the kernel below LOAD_PHYSICAL_ADDR (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Give up if memory attribute protocol returns an error (Lenny Szubowicz) [RHEL-2505] - x86/boot: Increase section and file alignment to 4k/512 (Lenny Szubowicz) [RHEL-2505] - x86/boot: Split off PE/COFF .data section (Lenny Szubowicz) [RHEL-2505] - x86/boot: Drop PE/COFF .reloc section (Lenny Szubowicz) [RHEL-2505] - x86/boot: Construct PE/COFF .text section from assembler (Lenny Szubowicz) [RHEL-2505] - x86/boot: Derive file size from _edata symbol (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed: Remove, discard, or assert for unwanted sections (Lenny Szubowicz) [RHEL-2505] - x86/boot: Check that there are no run-time relocations (Lenny Szubowicz) [RHEL-2505] - x86/boot: Discard .discard.unreachable for arch/x86/boot/compressed/vmlinux (Lenny Szubowicz) [RHEL-2505] - x86/boot: Define setup size in linker script (Lenny Szubowicz) [RHEL-2505] - x86/boot: Set EFI handover offset directly in header asm (Lenny Szubowicz) [RHEL-2505] - x86/boot: Drop references to startup_64 (Lenny Szubowicz) [RHEL-2505] - x86/boot: Drop redundant code setting the root device (Lenny Szubowicz) [RHEL-2505] - x86/build: Declutter the build output (Lenny Szubowicz) [RHEL-2505] - x86/boot: Omit compression buffer from PE/COFF image memory footprint (Lenny Szubowicz) [RHEL-2505] - x86/boot: Mark global variables as static (Lenny Szubowicz) [RHEL-2505] - efi/x86: Remove extra headroom for setup block (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove the 'bugger off' message (Lenny Szubowicz) [RHEL-2505] - x86/efi: Drop alignment flags from PE section headers (Lenny Szubowicz) [RHEL-2505] - efi: Put Linux specific magic number in the DOS header (Lenny Szubowicz) [RHEL-2505] - efi/x86: Fix the missing KASLR_FLAG bit in boot_params->hdr.loadflags (Lenny Szubowicz) [RHEL-2505] - efi/x86: Avoid physical KASLR on older Dell systems (Lenny Szubowicz) [RHEL-2505] - x86/boot: efistub: Assign global boot_params variable (Lenny Szubowicz) [RHEL-2505] - x86/boot: Rename conflicting 'boot_params' pointer to 'boot_params_ptr' (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Avoid legacy decompressor when doing EFI boot (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Perform SNP feature test while running in the firmware (Lenny Szubowicz) [RHEL-2505] - x86/sev: Do not try to parse for the CC blob on non-AMD hardware (Lenny Szubowicz) [RHEL-2505] - efi/libstub: Add limit argument to efi_random_alloc() (Lenny Szubowicz) [RHEL-2505] - arm64: efi: Limit allocations to 48-bit addressable physical region (Lenny Szubowicz) [RHEL-2505] - efi: libstub: use EFI_LOADER_CODE region when moving the kernel in memory (Lenny Szubowicz) [RHEL-2505] - arm64: efi: kaslr: Fix occasional random alloc (and boot) failure (Lenny Szubowicz) [RHEL-2505] - efi/libstub/random: Increase random alloc granularity (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Factor out kernel decompression and relocation (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Move global symbol references to C code (Lenny Szubowicz) [RHEL-2505] - decompress: Use 8 byte alignment (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Prefer EFI memory attributes protocol over DXE services (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Perform 4/5 level paging switch from the stub (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Merge trampoline cleanup with switching code (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Pass pgtable address to trampoline directly (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Only call the trampoline when changing paging levels (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Call trampoline directly from C code (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Avoid the need for a stack in the 32-bit trampoline (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Use standard calling convention for trampoline (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Call trampoline as a normal function (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Remove .bss/.pgtable from bzImage (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove run-time relocations from .head.text code (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Assign paging related global variables earlier (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Store boot_params pointer in callee save register (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Clear BSS in EFI handover protocol entrypoint (Lenny Szubowicz) [RHEL-2505] - x86/head_64: Store boot_params pointer in callee save register (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Don't rely on upper 32 bits of GPRs being preserved (Lenny Szubowicz) [RHEL-2505] - x86/head/64: Switch to KERNEL_CS as soon as new GDT is installed (Lenny Szubowicz) [RHEL-2505] - efi/libstub: Add memory attribute protocol definitions (Lenny Szubowicz) [RHEL-2505] - efi/x86: libstub: remove unused variable (Lenny Szubowicz) [RHEL-2505] - x86/boot: Robustify calling startup_{32,64}() from the decompressor code (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Simplify and clean up handover entry code (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Branch straight to kernel entry point from C code (Lenny Szubowicz) [RHEL-2505] - efi/x86: Avoid using code32_start (Lenny Szubowicz) [RHEL-2505] - efi/libstub/x86: Use Exit() boot service to exit the stub on errors (Lenny Szubowicz) [RHEL-2505] - efi: x86: Wipe setup_data on pure EFI boot (Lenny Szubowicz) [RHEL-2505] - efi: x86: Fix config name for setting the NX-compatibility flag in the PE header (Lenny Szubowicz) [RHEL-2505] - efi: x86: Set the NX-compatibility flag in the PE header (Lenny Szubowicz) [RHEL-2505] - efi/x86: Add kernel preferred address to PE header (Lenny Szubowicz) [RHEL-2505] - efi/x86: Use symbolic constants in PE header instead of bare numbers (Lenny Szubowicz) [RHEL-2505] - efi/x86: Drop redundant .bss section (Lenny Szubowicz) [RHEL-2505] - efi/x86: add headroom to decompressor BSS to account for setup block (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove run-time relocations from head_{32,64}.S (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed: Fix debug_puthex() parameter type (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Use 32-bit (zero-extended) MOV for z_output_len (Lenny Szubowicz) [RHEL-2505] - x86/boot: Use unsigned comparison for addresses (Lenny Szubowicz) [RHEL-2505] - x86/boot: Micro-optimize GDT loading instructions (Lenny Szubowicz) [RHEL-2505] - x86/boot: GDT limit value should be size - 1 (Lenny Szubowicz) [RHEL-2505] - efi/x86: Remove GDT setup from efi_main (Lenny Szubowicz) [RHEL-2505] - x86/boot: Clear direction and interrupt flags in startup_64 (Lenny Szubowicz) [RHEL-2505] - efi/x86: Don't depend on firmware GDT layout (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove KEEP_SEGMENTS support (Lenny Szubowicz) [RHEL-2505] - x86/boot: Handle malformed SRAT tables during early ACPI parsing (Lenny Szubowicz) [RHEL-2505] - efi/libstub/x86: Use mandatory 16-byte stack alignment in mixed mode (Lenny Szubowicz) [RHEL-2505] - efi/libstub/x86: Avoid globals to store context during mixed mode calls (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Disable paging at mixed mode entry (Lenny Szubowicz) [RHEL-2505] - x86: efi/random: Invoke EFI_RNG_PROTOCOL to seed the UEFI RNG table (Lenny Szubowicz) [RHEL-2505] - x86/asm: Make some functions local (Lenny Szubowicz) [RHEL-2505] - x86/boot: Annotate data appropriately (Lenny Szubowicz) [RHEL-2505] - x86/boot: Annotate local functions (Lenny Szubowicz) [RHEL-2505] - x86/asm: Make more symbols local (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Fix missing initialization in find_trampoline_placement() (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Fix boot on machines with broken E820 table (Lenny Szubowicz) [RHEL-2505] - x86, boot: Remove multiple copy of static function sanitize_boot_params() (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Remove unused variable (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Explain paging_prepare()'s return value (Lenny Szubowicz) [RHEL-2505] - x86/boot: Save several bytes in decompressor (Lenny Szubowicz) [RHEL-2505] - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (Audra Mitchell) [RHEL-20614] {CVE-2024-0841} - net/gve: update check for little-endianness in gve kconfig (Joshua Washington) [RHEL-29030] - [rt] build kernel-rt-4.18.0-546.rt7.335.el8 [RHEL-5332] - sched/membarrier: reduce the ability to hammer on sys_membarrier (Wander Lairson Costa) [RHEL-23430] {CVE-2024-26602} - NFS: Set the stable writes flag when initialising the super block (Benjamin Coddington) [RHEL-25266] - smb: client: fix OOB in receive_encrypted_standard() (Scott Mayhew) [RHEL-21685] {CVE-2024-0565} - scsi: core: Move scsi_host_busy() out of host lock if it is for per-command (Ming Lei) [RHEL-23942] - scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler (Ming Lei) [RHEL-23942] - gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump (Andrew Price) [RHEL-26501] {CVE-2023-52448} - smb: client: fix parsing of SMB3.1.1 POSIX create context (Paulo Alcantara) [RHEL-26241] {CVE-2023-52434} - smb: client: fix potential OOBs in smb2_parse_contexts() (Paulo Alcantara) [RHEL-26241] {CVE-2023-52434} - smb3: Replace smb2pdu 1-element arrays with flex-arrays (Jay Shin) [RHEL-22143] - cifs: Replace remaining 1-element arrays (Jay Shin) [RHEL-22143] - cifs: Convert struct fealist away from 1-element array (Jay Shin) [RHEL-22143] - cifs: remove unneeded 2bytes of padding from smb2 tree connect (Jay Shin) [RHEL-22143] - cifs: Replace zero-length arrays with flexible-array members (Jay Shin) [RHEL-22143] - cifs: Replace a couple of one-element arrays with flexible-array members (Jay Shin) [RHEL-22143] - cifs: fix FILE_BOTH_DIRECTORY_INFO definition (Jay Shin) [RHEL-22143] - nfsd: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - nfs: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - lockd: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - cifs: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - ceph: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - filelock: add a new locks_inode_context accessor function (Jeffrey Layton) [RHEL-27441] - dm-integrity, dm-verity: reduce stack usage for recheck (Benjamin Marzinski) [RHEL-27849] - dm-crypt: recheck the integrity tag after a failure (Benjamin Marzinski) [RHEL-27849] - dm-crypt: don't modify the data when using authenticated encryption (Benjamin Marzinski) [RHEL-27849] - dm-verity: recheck the hash after a failure (Benjamin Marzinski) [RHEL-27849] - dm-integrity: recheck the integrity tag after a failure (Benjamin Marzinski) [RHEL-27849] - [rt] build kernel-rt-4.18.0-545.rt7.334.el8 [RHEL-5332] - tracing/timerlat: Move hrtimer_init to timerlat_fd open() (John Kacur) [RHEL-26667] - tracing/perf: Fix double put of trace event when init fails (Michael Petlan) [RHEL-19537] - ipvlan: Add handling of NETDEV_UP events (Hangbin Liu) [RHEL-19098] - ceph: add ceph_cap_unlink_work to fire check_caps() immediately (Xiubo Li) [RHEL-21760] - ceph: always queue a writeback when revoking the Fb caps (Xiubo Li) [RHEL-21760] - ceph: always check dir caps asynchronously (Xiubo Li) [RHEL-21760] - nfs: fix redundant readdir request after get eof (Benjamin Coddington) [RHEL-7780] - NFSv4.1: fixup use EXCHGID4_FLAG_USE_PNFS_DS for DS server (Scott Mayhew) [RHEL-7994] - NFSv4.1: fix pnfs MDS=DS session trunking (Scott Mayhew) [RHEL-7994] - NFSv4.1: fix zero value filehandle in post open getattr (Scott Mayhew) [RHEL-7994] - NFSv4.1: use EXCHGID4_FLAG_USE_PNFS_DS for DS server (Scott Mayhew) [RHEL-7994] - x86/boot: Ignore NMIs during very early boot (Valentin Schneider) [RHEL-22749] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - vfs: use READ_ONCE() to access ->i_link (Jay Shin) [RHEL-141790] - fold generic_readlink() into its only caller (Jay Shin) [RHEL-141790] - fs/proc: fix uaf in proc_readdir_de() (Pavel Reichl) [RHEL-137093] {CVE-2025-40271} - Backport 'create an empty changelog file when changing its name' (Alexandra Hájková) - mptcp: fix race condition in mptcp_schedule_work() (Paolo Abeni) [RHEL-134443] {CVE-2025-40258} - mptcp: use mptcp_schedule_work instead of open-coding it (Paolo Abeni) [RHEL-134443] - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - tcp: minor optimization in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Kamal Heib) [RHEL-134347] {CVE-2025-38022} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - Bluetooth: hci_event: call disconnect callback before deleting conn (CKI Backport Bot) [RHEL-137039] {CVE-2023-53673} - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CKI Backport Bot) [RHEL-134423] {CVE-2025-40277} - xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 (John J Coleman) [RHEL-111354] - xen: Fix x86 sched_clock() interface for xen (John J Coleman) [RHEL-111354] - x86/xen/time: Output xen sched_clock time from 0 (John J Coleman) [RHEL-111354] - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Olga Kornievskaia) [RHEL-132819] - vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139273] {CVE-2025-40248} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ignore ndlp rport mismatch in dev_loss_tmo callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Modify handling of ADISC based on ndlp state and RPI registration (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Delete NLP_TARGET_REMOVE flag due to obsolete usage (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo callback (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Check devloss callbk done flag for potential stale NDLP ptrs (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kref imbalance on fabric ndlps from dev_loss_tmo handler (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Update PRLO handling in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Add condition to delete ndlp object after sending BLS_RJT to an ABTS (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove NLP_RCV_PLOGI early return during RSCN processing for ndlps (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Allow lpfc_plogi_confirm_nport() logic to execute for Fabric nodes (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix list_entry null check warning in lpfc_cmpl_els_plogi() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix possible file string name overflow when updating firmware (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Validate ELS LS_ACC completion payload (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove extra ndlp kref decrement in FLOGI cmpl for loop topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Revise NPIV ELS unsol rcv cmpl logic to drop ndlp based on nlp_state (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix double free in lpfc_cmpl_els_logo_acc() caused by lpfc_nlp_not_used() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Move scsi_host_template outside dynamically allocated/freed phba (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fill in missing ndlp kref puts in error paths (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login (Ewan D. Milne) [RHEL-32324] - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301} - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933} - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051} - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449] - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096} - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - vfs: use READ_ONCE() to access ->i_link (Jay Shin) [RHEL-141790] - fold generic_readlink() into its only caller (Jay Shin) [RHEL-141790] - fs/proc: fix uaf in proc_readdir_de() (Pavel Reichl) [RHEL-137093] {CVE-2025-40271} - Backport 'create an empty changelog file when changing its name' (Alexandra Hájková) - mptcp: fix race condition in mptcp_schedule_work() (Paolo Abeni) [RHEL-134443] {CVE-2025-40258} - mptcp: use mptcp_schedule_work instead of open-coding it (Paolo Abeni) [RHEL-134443] - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - tcp: minor optimization in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Kamal Heib) [RHEL-134347] {CVE-2025-38022} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - vfs: use READ_ONCE() to access ->i_link (Jay Shin) [RHEL-141790] - fold generic_readlink() into its only caller (Jay Shin) [RHEL-141790] - fs/proc: fix uaf in proc_readdir_de() (Pavel Reichl) [RHEL-137093] {CVE-2025-40271} - Backport 'create an empty changelog file when changing its name' (Alexandra Hájková) - mptcp: fix race condition in mptcp_schedule_work() (Paolo Abeni) [RHEL-134443] {CVE-2025-40258} - mptcp: use mptcp_schedule_work instead of open-coding it (Paolo Abeni) [RHEL-134443] - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - tcp: minor optimization in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Kamal Heib) [RHEL-134347] {CVE-2025-38022} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - autofs: use wake_up() instead of wake_up_interruptible(() (Ian Kent) [RHEL-143685] - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Ian Kent) [RHEL-143685] {CVE-2023-54134} - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141709] - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-136693] - audit: merge loops in __audit_inode_child() (Ricardo Robaina) [RHEL-140442] - bridge: mcast: Fix use-after-free during router port configuration (Mohammad Heib) [RHEL-138422] {CVE-2025-38248} - net/sched: Enforce that teql can only be used as root qdisc (CKI Backport Bot) [RHEL-146992] {CVE-2026-23074} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Marc Milgram) [RHEL-137838] {CVE-2025-38129} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143189] {CVE-2025-68800} - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126886] {CVE-2025-40064} - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147261] {CVE-2026-23097} - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-134673] - autofs: use wake_up() instead of wake_up_interruptible(() (Ian Kent) [RHEL-143685] - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Ian Kent) [RHEL-143685] {CVE-2023-54134} - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141709] - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-136693] - audit: merge loops in __audit_inode_child() (Ricardo Robaina) [RHEL-140442] - bridge: mcast: Fix use-after-free during router port configuration (Mohammad Heib) [RHEL-138422] {CVE-2025-38248} - net/sched: Enforce that teql can only be used as root qdisc (CKI Backport Bot) [RHEL-146992] {CVE-2026-23074} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Marc Milgram) [RHEL-137838] {CVE-2025-38129} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143189] {CVE-2025-68800} - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126886] {CVE-2025-40064} - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - macvlan: fix possible UAF in macvlan_forward_source() (Hangbin Liu) [RHEL-144120] {CVE-2026-23001} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-131922] - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount (Jocelyn Falempe) [RHEL-148636] - audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd references (Waiman Long) [RHEL-146026] - fs: Add a pool of extra fs->pwd references to fs_struct (Waiman Long) [RHEL-146026] - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143535] {CVE-2025-71085} - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147261] {CVE-2026-23097} - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-134673] - autofs: use wake_up() instead of wake_up_interruptible(() (Ian Kent) [RHEL-143685] - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Ian Kent) [RHEL-143685] {CVE-2023-54134} - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141709] - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-136693] - audit: merge loops in __audit_inode_child() (Ricardo Robaina) [RHEL-140442] - bridge: mcast: Fix use-after-free during router port configuration (Mohammad Heib) [RHEL-138422] {CVE-2025-38248} - net/sched: Enforce that teql can only be used as root qdisc (CKI Backport Bot) [RHEL-146992] {CVE-2026-23074} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Marc Milgram) [RHEL-137838] {CVE-2025-38129} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143189] {CVE-2025-68800} - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126886] {CVE-2025-40064} - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - x86/microcode/AMD: Revert "Backport AMD microcode commits for better microcode loading support" (Waiman Long) [RHEL-155860] - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150398] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150398] - tcp: fix forever orphan socket caused by tcp_abort (Paolo Abeni) [RHEL-146187] - xfs: fix minimum agno handling for xfs alloc modes in RHEL8 (Brian Foster) [RHEL-102464] - xfs: fix uninitialized use of flags variable in xfs_alloc_vextent() (Brian Foster) [RHEL-102464] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82523] - tcp: use this_cpu_read(*X) instead of *this_cpu_ptr(X) (Davide Caratti) [RHEL-82523] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150221] - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150221] {CVE-2026-23209} - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) [RHEL-96016] - s390/kexec: Emit an error message when cmdline is too long (Mete Durlu) [RHEL-144946] - s390/boot: Fix kernel size in bootparm area (Mete Durlu) [RHEL-144946] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-137123] - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-151614] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove useless transaction in evict_linked_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-151614] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-151614] - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146419] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146419] {CVE-2025-38323} - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136288] - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136288] - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136288] - scsi: st: Tighten the page format heuristics with MODE SELECT (John Meneghini) [RHEL-136288] - scsi: st: ERASE does not change tape location (John Meneghini) [RHEL-136288] - scsi: st: Fix array overflow in st_setup() (John Meneghini) [RHEL-136288] - scsi: st: Add sysfs file position_lost_in_reset (John Meneghini) [RHEL-136288] - scsi: st: Modify st.c to use the new scsi_error counters (John Meneghini) [RHEL-136288] - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (John Meneghini) [RHEL-136288] - scsi: st: Restore some drive settings after reset (John Meneghini) [RHEL-136288] - scsi: st: Fix input/output error on empty drive reset (John Meneghini) [RHEL-136288] - smb: client: handle lack of IPC in dfs_cache_refresh() (Paulo Alcantara) [RHEL-138235] - smb: client: allow parsing zero-length AV pairs (Paulo Alcantara) [RHEL-138235] - cifs: reduce warning log level for server not advertising interfaces (Paulo Alcantara) [RHEL-138235] - smb: client: Fix match_session bug preventing session reuse (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of kstrdup() in get_ses_refpath() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy when tree connecting to DFS interlink targets (Paulo Alcantara) [RHEL-138235] - smb: client: don't trust DFSREF_STORAGE_SERVER bit (Paulo Alcantara) [RHEL-138235] - smb: client: don't check for @leaf_fullpath in match_server() (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of TCP_Server_Info::refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: don't retry DFS targets on server shutdown (Paulo Alcantara) [RHEL-138235] - smb: client: fix return value of parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: optimize referral walk on failed link targets (Paulo Alcantara) [RHEL-138235] - smb: client: provide dns_resolve_{unc,name} helpers (Paulo Alcantara) [RHEL-138235] - smb: client: parse DNS domain name from domain= option (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS mount against old servers with NTLMSSP (Paulo Alcantara) [RHEL-138235] - smb: client: parse av pair type 4 in CHALLENGE_MESSAGE (Paulo Alcantara) [RHEL-138235] - smb: client: introduce av_for_each_entry() helper (Paulo Alcantara) [RHEL-138235] - smb: client: fix double free of TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-138235] {CVE-2025-21673} - smb: client: fix potential race in cifs_put_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy message when mounting shares (Paulo Alcantara) [RHEL-138235] - smb: client: don't try following DFS links in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow reconnect when sending ioctl (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of @nlsc param in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow more DFS referrals to be cached (Paulo Alcantara) [RHEL-138235] - smb: client: propagate error from cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS failover in multiuser mounts (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS interlink failover (Paulo Alcantara) [RHEL-138235] - smb: client: improve purging of cached referrals (Paulo Alcantara) [RHEL-138235] - smb: client: avoid unnecessary reconnects when refreshing referrals (Paulo Alcantara) [RHEL-138235] - smb: client: serialise cifs_construct_tcon() with cifs_mount_mutex (Paulo Alcantara) [RHEL-138235] - smb: client: handle DFS tcons in cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: refresh referral without acquiring refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: guarantee refcounted children from parent session (Paulo Alcantara) [RHEL-138235] {CVE-2024-35869} - smb: client: set correct id, uid and cruid for multiuser automounts (Paulo Alcantara) [RHEL-138235] {CVE-2024-26822} - cifs: change tcon status when need_reconnect is set on it (Paulo Alcantara) [RHEL-138235] - smb: client: fix potential NULL deref in parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: fix mount when dns_resolver key is not available (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs code dep in namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs naming in automount code (Paulo Alcantara) [RHEL-138235] - smb: client: rename cifs_dfs_ref.c to namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: ensure to try all targets when finding nested links (Paulo Alcantara) [RHEL-138235] - smb: client: introduce DFS_CACHE_TGT_LIST() (Paulo Alcantara) [RHEL-138235] - smb: client: fix null auth (Paulo Alcantara) [RHEL-138235] - smb: client: fix dfs link mount against w2k8 (Paulo Alcantara) [RHEL-138235] - cifs: fix charset issue in reconnection (Paulo Alcantara) [RHEL-138235] - smb: client: fix missed ses refcounting (Paulo Alcantara) [RHEL-138235] {CVE-2023-54076} - fs/nls: make load_nls() take a const parameter (Paulo Alcantara) [RHEL-138235] - smb: client: remove redundant pointer 'server' (Paulo Alcantara) [RHEL-138235] - smb: client: improve DFS mount check (Paulo Alcantara) [RHEL-138235] - smb: client: fix shared DFS root mounts with different prefixes (Paulo Alcantara) [RHEL-138235] - smb: client: fix parsing of source mount option (Paulo Alcantara) [RHEL-138235] - smb: client: fix warning in cifs_match_super() (Paulo Alcantara) [RHEL-138235] - cifs: fix max_credits implementation (Paulo Alcantara) [RHEL-138235] - cifs: fix sockaddr comparison in iface_cmp (Paulo Alcantara) [RHEL-138235] - cifs: fix status checks in cifs_tree_connect (Paulo Alcantara) [RHEL-138235] - cifs: fix smb1 mount regression (Paulo Alcantara) [RHEL-138235] - cifs: fix sharing of DFS connections (Paulo Alcantara) [RHEL-138235] - cifs: avoid potential races when handling multiple dfs tcons (Paulo Alcantara) [RHEL-138235] - cifs: protect access of TCP_Server_Info::{origin,leaf}_fullpath (Paulo Alcantara) [RHEL-138235] - cifs: avoid dup prefix path in dfs_get_automount_devname() (Paulo Alcantara) [RHEL-138235] - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL (Paulo Alcantara) [RHEL-138235] {CVE-2023-53246} - smb3: fix unusable share after force unmount failure (Paulo Alcantara) [RHEL-138235] - cifs: check only tcon status on tcon related functions (Paulo Alcantara) [RHEL-138235] - cifs: return DFS root session id in DebugData (Paulo Alcantara) [RHEL-138235] - cifs: fix use-after-free bug in refresh_cache_worker() (Paulo Alcantara) [RHEL-138235] {CVE-2023-53052} - cifs: set DFS root session in cifs_get_smb_ses() (Paulo Alcantara) [RHEL-138235] - cifs: remove unused function (Paulo Alcantara) [RHEL-138235] - cifs: remove duplicate code in __refresh_tcon() (Paulo Alcantara) [RHEL-138235] - cifs: remove redundant assignment to the variable match (Paulo Alcantara) [RHEL-138235] - cifs: use origin fullpath for automounts (Paulo Alcantara) [RHEL-138235] - cifs: fix source pathname comparison of dfs supers (Paulo Alcantara) [RHEL-138235] - cifs: fix confusing debug message (Paulo Alcantara) [RHEL-138235] - cifs: don't block in dfs_cache_noreq_update_tgthint() (Paulo Alcantara) [RHEL-138235] - cifs: refresh root referrals (Paulo Alcantara) [RHEL-138235] - cifs: fix refresh of cached referrals (Paulo Alcantara) [RHEL-138235] - cifs: share dfs connections and supers (Paulo Alcantara) [RHEL-138235] - cifs: split out ses and tcon retrieval from mount_get_conns() (Paulo Alcantara) [RHEL-138235] - cifs: set resolved ip in sockaddr (Paulo Alcantara) [RHEL-138235] - cifs: remove unused smb3_fs_context::mount_options (Paulo Alcantara) [RHEL-138235] - cifs: get rid of mount options string parsing (Paulo Alcantara) [RHEL-138235] - cifs: use fs_context for automounts (Paulo Alcantara) [RHEL-138235] - cifs: remove various function description warnings (Paulo Alcantara) [RHEL-138235] - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Select which microcode patch to load (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add more known models to entry sign checking (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Limit Entrysign signature checking to known generations (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use sha256() instead of init/update/final (Waiman Long) [RHEL-132479] - x86/microcode: Fix Entrysign revision check for Zen1/Naples (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Handle the case of no BIOS microcode (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add some forgotten models to the SHA check (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Load only SHA256-checksummed patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add get_patch_level() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Merge early_apply_microcode() into its single callsite (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Have __apply_microcode_amd() return bool (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Flush patch buffer mapping after application (Waiman Long) [RHEL-132479] - x86/mm: Carve out INVLPG inline asm for use by others (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Split load_microcode_amd() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Pay attention to the stepping dynamically (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix a -Wsometimes-uninitialized clang false positive (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use the family,model,stepping encoded in the patch ID (Waiman Long) [RHEL-132479] - x86/microcode/amd: Cache builtin microcode too (Waiman Long) [RHEL-132479] - x86/microcode/amd: Use correct per CPU ucode_cpu_info (Waiman Long) [RHEL-132479] - x86/microcode/amd: Remove X86_32 specific code in early_apply_microcode() & get_builtin_microcode() (Waiman Long) [RHEL-132479] - x86/microcode: Move core specific defines to local header (Waiman Long) [RHEL-132479] - x86/microcode/intel: Rename get_datasize() since its used externally (Waiman Long) [RHEL-132479] - x86/microcode: Make reload_early_microcode() static (Waiman Long) [RHEL-132479] - x86/microcode: Include vendor headers into microcode.h (Waiman Long) [RHEL-132479] - x86/microcode/intel: Move microcode functions out of cpu/intel.c (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Get rid of __find_equiv_id() (Waiman Long) [RHEL-132479] - x86/microcode: Add explicit CPU vendor dependency (Waiman Long) [RHEL-132479] - macvlan: fix possible UAF in macvlan_forward_source() (Hangbin Liu) [RHEL-144120] {CVE-2026-23001} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-131922] - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount (Jocelyn Falempe) [RHEL-148636] - audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd references (Waiman Long) [RHEL-146026] - fs: Add a pool of extra fs->pwd references to fs_struct (Waiman Long) [RHEL-146026] - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143535] {CVE-2025-71085} - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147261] {CVE-2026-23097} - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-134673] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930] - NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242] - pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242] - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242] - NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242] - NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242] - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242] - SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242] - NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242] - SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242] - SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242] - SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242] - SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242] - NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242] - NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419] - nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419] - pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419] - NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419] - NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419] - NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419] - NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419] - NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419] - NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419] - NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419] - NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419] - NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419] - nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419] - nfs: always check dreq->error after a commit (Mike Snitzer) [RHEL-156419] - nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419] - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231} - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942] - x86/microcode/AMD: Revert "Backport AMD microcode commits for better microcode loading support" (Waiman Long) [RHEL-155860] - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150398] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150398] - tcp: fix forever orphan socket caused by tcp_abort (Paolo Abeni) [RHEL-146187] - xfs: fix minimum agno handling for xfs alloc modes in RHEL8 (Brian Foster) [RHEL-102464] - xfs: fix uninitialized use of flags variable in xfs_alloc_vextent() (Brian Foster) [RHEL-102464] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82523] - tcp: use this_cpu_read(*X) instead of *this_cpu_ptr(X) (Davide Caratti) [RHEL-82523] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150221] - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150221] {CVE-2026-23209} - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) [RHEL-96016] - s390/kexec: Emit an error message when cmdline is too long (Mete Durlu) [RHEL-144946] - s390/boot: Fix kernel size in bootparm area (Mete Durlu) [RHEL-144946] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-137123] - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-151614] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove useless transaction in evict_linked_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-151614] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-151614] - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146419] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146419] {CVE-2025-38323} - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136288] - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136288] - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136288] - scsi: st: Tighten the page format heuristics with MODE SELECT (John Meneghini) [RHEL-136288] - scsi: st: ERASE does not change tape location (John Meneghini) [RHEL-136288] - scsi: st: Fix array overflow in st_setup() (John Meneghini) [RHEL-136288] - scsi: st: Add sysfs file position_lost_in_reset (John Meneghini) [RHEL-136288] - scsi: st: Modify st.c to use the new scsi_error counters (John Meneghini) [RHEL-136288] - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (John Meneghini) [RHEL-136288] - scsi: st: Restore some drive settings after reset (John Meneghini) [RHEL-136288] - scsi: st: Fix input/output error on empty drive reset (John Meneghini) [RHEL-136288] - smb: client: handle lack of IPC in dfs_cache_refresh() (Paulo Alcantara) [RHEL-138235] - smb: client: allow parsing zero-length AV pairs (Paulo Alcantara) [RHEL-138235] - cifs: reduce warning log level for server not advertising interfaces (Paulo Alcantara) [RHEL-138235] - smb: client: Fix match_session bug preventing session reuse (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of kstrdup() in get_ses_refpath() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy when tree connecting to DFS interlink targets (Paulo Alcantara) [RHEL-138235] - smb: client: don't trust DFSREF_STORAGE_SERVER bit (Paulo Alcantara) [RHEL-138235] - smb: client: don't check for @leaf_fullpath in match_server() (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of TCP_Server_Info::refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: don't retry DFS targets on server shutdown (Paulo Alcantara) [RHEL-138235] - smb: client: fix return value of parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: optimize referral walk on failed link targets (Paulo Alcantara) [RHEL-138235] - smb: client: provide dns_resolve_{unc,name} helpers (Paulo Alcantara) [RHEL-138235] - smb: client: parse DNS domain name from domain= option (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS mount against old servers with NTLMSSP (Paulo Alcantara) [RHEL-138235] - smb: client: parse av pair type 4 in CHALLENGE_MESSAGE (Paulo Alcantara) [RHEL-138235] - smb: client: introduce av_for_each_entry() helper (Paulo Alcantara) [RHEL-138235] - smb: client: fix double free of TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-138235] {CVE-2025-21673} - smb: client: fix potential race in cifs_put_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy message when mounting shares (Paulo Alcantara) [RHEL-138235] - smb: client: don't try following DFS links in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow reconnect when sending ioctl (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of @nlsc param in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow more DFS referrals to be cached (Paulo Alcantara) [RHEL-138235] - smb: client: propagate error from cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS failover in multiuser mounts (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS interlink failover (Paulo Alcantara) [RHEL-138235] - smb: client: improve purging of cached referrals (Paulo Alcantara) [RHEL-138235] - smb: client: avoid unnecessary reconnects when refreshing referrals (Paulo Alcantara) [RHEL-138235] - smb: client: serialise cifs_construct_tcon() with cifs_mount_mutex (Paulo Alcantara) [RHEL-138235] - smb: client: handle DFS tcons in cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: refresh referral without acquiring refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: guarantee refcounted children from parent session (Paulo Alcantara) [RHEL-138235] {CVE-2024-35869} - smb: client: set correct id, uid and cruid for multiuser automounts (Paulo Alcantara) [RHEL-138235] {CVE-2024-26822} - cifs: change tcon status when need_reconnect is set on it (Paulo Alcantara) [RHEL-138235] - smb: client: fix potential NULL deref in parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: fix mount when dns_resolver key is not available (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs code dep in namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs naming in automount code (Paulo Alcantara) [RHEL-138235] - smb: client: rename cifs_dfs_ref.c to namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: ensure to try all targets when finding nested links (Paulo Alcantara) [RHEL-138235] - smb: client: introduce DFS_CACHE_TGT_LIST() (Paulo Alcantara) [RHEL-138235] - smb: client: fix null auth (Paulo Alcantara) [RHEL-138235] - smb: client: fix dfs link mount against w2k8 (Paulo Alcantara) [RHEL-138235] - cifs: fix charset issue in reconnection (Paulo Alcantara) [RHEL-138235] - smb: client: fix missed ses refcounting (Paulo Alcantara) [RHEL-138235] {CVE-2023-54076} - fs/nls: make load_nls() take a const parameter (Paulo Alcantara) [RHEL-138235] - smb: client: remove redundant pointer 'server' (Paulo Alcantara) [RHEL-138235] - smb: client: improve DFS mount check (Paulo Alcantara) [RHEL-138235] - smb: client: fix shared DFS root mounts with different prefixes (Paulo Alcantara) [RHEL-138235] - smb: client: fix parsing of source mount option (Paulo Alcantara) [RHEL-138235] - smb: client: fix warning in cifs_match_super() (Paulo Alcantara) [RHEL-138235] - cifs: fix max_credits implementation (Paulo Alcantara) [RHEL-138235] - cifs: fix sockaddr comparison in iface_cmp (Paulo Alcantara) [RHEL-138235] - cifs: fix status checks in cifs_tree_connect (Paulo Alcantara) [RHEL-138235] - cifs: fix smb1 mount regression (Paulo Alcantara) [RHEL-138235] - cifs: fix sharing of DFS connections (Paulo Alcantara) [RHEL-138235] - cifs: avoid potential races when handling multiple dfs tcons (Paulo Alcantara) [RHEL-138235] - cifs: protect access of TCP_Server_Info::{origin,leaf}_fullpath (Paulo Alcantara) [RHEL-138235] - cifs: avoid dup prefix path in dfs_get_automount_devname() (Paulo Alcantara) [RHEL-138235] - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL (Paulo Alcantara) [RHEL-138235] {CVE-2023-53246} - smb3: fix unusable share after force unmount failure (Paulo Alcantara) [RHEL-138235] - cifs: check only tcon status on tcon related functions (Paulo Alcantara) [RHEL-138235] - cifs: return DFS root session id in DebugData (Paulo Alcantara) [RHEL-138235] - cifs: fix use-after-free bug in refresh_cache_worker() (Paulo Alcantara) [RHEL-138235] {CVE-2023-53052} - cifs: set DFS root session in cifs_get_smb_ses() (Paulo Alcantara) [RHEL-138235] - cifs: remove unused function (Paulo Alcantara) [RHEL-138235] - cifs: remove duplicate code in __refresh_tcon() (Paulo Alcantara) [RHEL-138235] - cifs: remove redundant assignment to the variable match (Paulo Alcantara) [RHEL-138235] - cifs: use origin fullpath for automounts (Paulo Alcantara) [RHEL-138235] - cifs: fix source pathname comparison of dfs supers (Paulo Alcantara) [RHEL-138235] - cifs: fix confusing debug message (Paulo Alcantara) [RHEL-138235] - cifs: don't block in dfs_cache_noreq_update_tgthint() (Paulo Alcantara) [RHEL-138235] - cifs: refresh root referrals (Paulo Alcantara) [RHEL-138235] - cifs: fix refresh of cached referrals (Paulo Alcantara) [RHEL-138235] - cifs: share dfs connections and supers (Paulo Alcantara) [RHEL-138235] - cifs: split out ses and tcon retrieval from mount_get_conns() (Paulo Alcantara) [RHEL-138235] - cifs: set resolved ip in sockaddr (Paulo Alcantara) [RHEL-138235] - cifs: remove unused smb3_fs_context::mount_options (Paulo Alcantara) [RHEL-138235] - cifs: get rid of mount options string parsing (Paulo Alcantara) [RHEL-138235] - cifs: use fs_context for automounts (Paulo Alcantara) [RHEL-138235] - cifs: remove various function description warnings (Paulo Alcantara) [RHEL-138235] - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Select which microcode patch to load (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add more known models to entry sign checking (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Limit Entrysign signature checking to known generations (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use sha256() instead of init/update/final (Waiman Long) [RHEL-132479] - x86/microcode: Fix Entrysign revision check for Zen1/Naples (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Handle the case of no BIOS microcode (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add some forgotten models to the SHA check (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Load only SHA256-checksummed patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add get_patch_level() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Merge early_apply_microcode() into its single callsite (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Have __apply_microcode_amd() return bool (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Flush patch buffer mapping after application (Waiman Long) [RHEL-132479] - x86/mm: Carve out INVLPG inline asm for use by others (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Split load_microcode_amd() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Pay attention to the stepping dynamically (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix a -Wsometimes-uninitialized clang false positive (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use the family,model,stepping encoded in the patch ID (Waiman Long) [RHEL-132479] - x86/microcode/amd: Cache builtin microcode too (Waiman Long) [RHEL-132479] - x86/microcode/amd: Use correct per CPU ucode_cpu_info (Waiman Long) [RHEL-132479] - x86/microcode/amd: Remove X86_32 specific code in early_apply_microcode() & get_builtin_microcode() (Waiman Long) [RHEL-132479] - x86/microcode: Move core specific defines to local header (Waiman Long) [RHEL-132479] - x86/microcode/intel: Rename get_datasize() since its used externally (Waiman Long) [RHEL-132479] - x86/microcode: Make reload_early_microcode() static (Waiman Long) [RHEL-132479] - x86/microcode: Include vendor headers into microcode.h (Waiman Long) [RHEL-132479] - x86/microcode/intel: Move microcode functions out of cpu/intel.c (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Get rid of __find_equiv_id() (Waiman Long) [RHEL-132479] - x86/microcode: Add explicit CPU vendor dependency (Waiman Long) [RHEL-132479] - macvlan: fix possible UAF in macvlan_forward_source() (Hangbin Liu) [RHEL-144120] {CVE-2026-23001} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-131922] - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount (Jocelyn Falempe) [RHEL-148636] - audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd references (Waiman Long) [RHEL-146026] - fs: Add a pool of extra fs->pwd references to fs_struct (Waiman Long) [RHEL-146026] - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143535] {CVE-2025-71085} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930] - NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242] - pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242] - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242] - NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242] - NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242] - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242] - SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242] - NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242] - SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242] - SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242] - SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242] - SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242] - NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242] - NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419] - nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419] - pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419] - NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419] - NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419] - NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419] - NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419] - NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419] - NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419] - NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419] - NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419] - NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419] - nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419] - nfs: always check dreq->error after a commit (Mike Snitzer) [RHEL-156419] - nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419] - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231} - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942] - x86/microcode/AMD: Revert "Backport AMD microcode commits for better microcode loading support" (Waiman Long) [RHEL-155860] - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150398] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150398] - tcp: fix forever orphan socket caused by tcp_abort (Paolo Abeni) [RHEL-146187] - xfs: fix minimum agno handling for xfs alloc modes in RHEL8 (Brian Foster) [RHEL-102464] - xfs: fix uninitialized use of flags variable in xfs_alloc_vextent() (Brian Foster) [RHEL-102464] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82523] - tcp: use this_cpu_read(*X) instead of *this_cpu_ptr(X) (Davide Caratti) [RHEL-82523] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150221] - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150221] {CVE-2026-23209} - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) [RHEL-96016] - s390/kexec: Emit an error message when cmdline is too long (Mete Durlu) [RHEL-144946] - s390/boot: Fix kernel size in bootparm area (Mete Durlu) [RHEL-144946] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-137123] - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-151614] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove useless transaction in evict_linked_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-151614] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-151614] - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146419] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146419] {CVE-2025-38323} - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136288] - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136288] - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136288] - scsi: st: Tighten the page format heuristics with MODE SELECT (John Meneghini) [RHEL-136288] - scsi: st: ERASE does not change tape location (John Meneghini) [RHEL-136288] - scsi: st: Fix array overflow in st_setup() (John Meneghini) [RHEL-136288] - scsi: st: Add sysfs file position_lost_in_reset (John Meneghini) [RHEL-136288] - scsi: st: Modify st.c to use the new scsi_error counters (John Meneghini) [RHEL-136288] - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (John Meneghini) [RHEL-136288] - scsi: st: Restore some drive settings after reset (John Meneghini) [RHEL-136288] - scsi: st: Fix input/output error on empty drive reset (John Meneghini) [RHEL-136288] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930] - NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242] - pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242] - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242] - NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242] - NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242] - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242] - SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242] - NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242] - SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242] - SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242] - SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242] - SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242] - NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242] - NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419] - nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419] - pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419] - NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419] - NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419] - NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419] - NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419] - NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419] - NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419] - NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419] - NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419] - NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419] - nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419] - nfs: always check dreq->error after a commit (Mike Snitzer) [RHEL-156419] - nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419] - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231} - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942] - xfrm: esp: avoid in-place decrypt on shared skb frags - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772] - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772] - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772] - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772] - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772] - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772] - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709} - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815] - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815] - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815] - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190} - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408} - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684} - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032] - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032] - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032] - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032] - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032] - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032] - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032] - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032] - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032] - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183} - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219] - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219] - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219] - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219] - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219] - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219] - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219] - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347} - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243} - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890] - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890] - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890] - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890] - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890] - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890] - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890] - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613} - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961] - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858} - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392} - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781} - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990} - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772] - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772] - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772] - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772] - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772] - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772] - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709} - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815] - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815] - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815] - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190} - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408} - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684} - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032] - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032] - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032] - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032] - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032] - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032] - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032] - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032] - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032] - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183} - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219] - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219] - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219] - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219] - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219] - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219] - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219] - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347} - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243} - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890] - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890] - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890] - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890] - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890] - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890] - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890] - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613} - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961] - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858} - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392} - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781} - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990} - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772] - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772] - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772] - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772] - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772] - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772] - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709} - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815] - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815] - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815] - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190} - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408} - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684} - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032] - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032] - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032] - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032] - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032] - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032] - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032] - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032] - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032] - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183} - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219] - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219] - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219] - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219] - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219] - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219] - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219] - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347} - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243} - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890] - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890] - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890] - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890] - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890] - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890] - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890] - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613} - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961] - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858} - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392} - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781} - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - [rt] build kernel-rt-4.18.0-553.16.1.rt7.357.el8_10 [RHEL-44553] - x86/bhi: Fix incorrect CLEAR_BRANCH_HISTORY position in entry_INT80_compat (Waiman Long) [RHEL-50648] - [rt] build kernel-rt-4.18.0-553.15.1.rt7.356.el8_10 [RHEL-44553] - Revert "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-44613] - ionic: fix use after netif_napi_del() (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - ionic: clean interrupt before enabling queue to avoid credit race (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change (CKI Backport Bot) [RHEL-49321] {CVE-2021-47624} - xhci: Handle TD clearing for multiple streams case (CKI Backport Bot) [RHEL-47882] {CVE-2024-40927} - net: openvswitch: Fix Use-After-Free in ovs_ct_exit (cki-backport-bot) [RHEL-36362] {CVE-2024-27395} - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: fix vlan use-after-free (cki-backport-bot) [RHEL-43721] {CVE-2024-36979} - irqchip/gic-v3-its: Prevent double free on error (Charles Mirabile) [RHEL-37022] {CVE-2024-35847} - irqchip/gic-v3-its: Fix potential VPE leak on error (Charles Mirabile) [RHEL-37744] {CVE-2021-47373} - i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() (Charles Mirabile) [RHEL-34735] {CVE-2022-48632} - iommu/dma: fix zeroing of bounce buffer padding used by untrusted devices (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: remove alloc_size argument to swiotlb_tbl_map_single() (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: fix swiotlb_bounce() to do partial sync's correctly (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Reinstate page-alignment for mappings >= PAGE_SIZE (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix alignment checks when both allocation and DMA masks are present (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix double-allocation of slots due to broken alignment handling (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (cki-backport-bot) [RHEL-44441] {CVE-2024-31076} - [rt] build kernel-rt-4.18.0-553.14.1.rt7.355.el8_10 [RHEL-44553] - s390/qeth: Fix kernel panic after setting hsuid (Mete Durlu) [RHEL-49754] - perf/core: Protect event sibling list locking against interrupt inversion (Daniel Vacek) [RHEL-31798] - vt: fix unicode buffer corruption when deleting characters (Steve Best) [RHEL-36936] {CVE-2024-35823} - cifs: translate network errors on send to -ECONNABORTED (Paulo Alcantara) [RHEL-36754] - xfs: don't block in busy flushing when freeing extents (Brian Foster) [RHEL-7984] - xfs: allow extent free intents to be retried (Brian Foster) [RHEL-7984] - xfs: pass alloc flags through to xfs_extent_busy_flush() (Brian Foster) [RHEL-7984] - xfs: use deferred frees for btree block freeing (Brian Foster) [RHEL-7984] - xfs: fix bounds check in xfs_defer_agfl_block() (Brian Foster) [RHEL-7984] - xfs: validate block number being freed before adding to xefi (Brian Foster) [RHEL-7984] - xfs: rename xfs_bmap_add_free to xfs_free_extent_later (Brian Foster) [RHEL-7984] - usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (Desnes Nunes) [RHEL-36803] {CVE-2024-35790} - stm class: Fix a double free in stm_register_device() (Steve Best) [RHEL-44514] {CVE-2024-38627} - s390/qeth: Fix potential loss of L3-IP@ in case of network issues (Mete Durlu) [RHEL-49755] - tls: fix missing memory barrier in tls_init (cki-backport-bot) [RHEL-44471] {CVE-2024-36489} - xfs: fix log recovery buffer allocation for the legacy h_size fixup (Bill O'Donnell) [RHEL-46473] {CVE-2024-39472} - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: use __for_each_thread() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - exit: Use the correct exit_code in /proc/<pid>/stat (Brian Foster) [RHEL-31562] {CVE-2024-26686} - scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool (Ewan D. Milne) [RHEL-38283] {CVE-2023-52811} - scsi: qla2xxx: Fix double free of fcport (Ewan D. Milne) [RHEL-39549] {CVE-2024-26929} - scsi: qla2xxx: Fix double free of the ha->vp_map pointer (Ewan D. Milne) [RHEL-39549] {CVE-2024-26930} - scsi: qla2xxx: Fix command flush on cable pull (Ewan D. Milne) [RHEL-39549] {CVE-2024-26931} - [rt] build kernel-rt-4.18.0-553.13.1.rt7.354.el8_10 [RHEL-44553] - redhat: remove handling of deleted rhdocs/ directory from genspec.sh (Denys Vlasenko) - x86/bugs: Fix BHI retpoline check (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI handling of RRSBA (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr' (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI documentation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix return type of spectre_bhi_state() (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Make CONFIG_SPECTRE_BHI_ON the default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Mitigate KVM by default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add BHI mitigation knob (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Enumerate Branch History Injection (BHI) bug (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Define SPEC_CTRL_BHI_DIS_S (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add support for clearing branch history at syscall entry (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file (Waiman Long) [RHEL-28202] - perf/x86/amd/lbr: Use freeze based on availability (Waiman Long) [RHEL-28202] - Documentation/kernel-parameters: Add spec_rstack_overflow to mitigations=off (Waiman Long) [RHEL-28202] - KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace (Waiman Long) [RHEL-28202] - x86/bugs: Reset speculation control settings on init (Waiman Long) [RHEL-28202] - KVM: x86: Update KVM-only leaf handling to allow for 100% KVM-only leafs (Waiman Long) [RHEL-28202] - KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest (Waiman Long) [RHEL-28202] - mptcp: ensure snd_nxt is properly initialized on connect (Davide Caratti) [RHEL-39865] {CVE-2024-36889} - powerpc/pseries: Enforce hcall result buffer validity and size (Mamatha Inamdar) [RHEL-48291] {CVE-2024-40974} - wifi: mac80211: fix potential key use-after-free (Jose Ignacio Tornos Martinez) [RHEL-28007] {CVE-2023-52530} - cppc_cpufreq: Fix possible null pointer dereference (Mark Langsdorf) [RHEL-44137] {CVE-2024-38573} - net/sched: act_mirred: use the backlog for mirred ingress (Davide Caratti) [RHEL-31718] {CVE-2024-26740} - vfio/pci: Lock external INTx masking ops (Alex Williamson) [RHEL-31922] {CVE-2024-26810} - net: sched: sch_multiq: fix possible OOB write in multiq_tune() (Davide Caratti) [RHEL-43464] {CVE-2024-36978} - tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized (Guillaume Nault) [RHEL-37850] {CVE-2021-47304} - pstore/ram: Fix crash when setting number of cpus to an odd number (Lenny Szubowicz) [RHEL-29471] {CVE-2023-52619} - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node (Jocelyn Falempe) [RHEL-37101] {CVE-2023-52662} - drm/vmwgfx: Fix the lifetime of the bo cursor memory (Jocelyn Falempe) [RHEL-36962] {CVE-2024-35810} - drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed (Jocelyn Falempe) [RHEL-34987] {CVE-2024-26940} - drm/vmwgfx: Unmap the surface before resetting it on a plane state (Jocelyn Falempe) [RHEL-35217] {CVE-2023-52648} - drm/vmwgfx: Fix invalid reads in fence signaled events (Jocelyn Falempe) [RHEL-40010] {CVE-2024-36960} - block: Fix wrong offset in bio_truncate() (Ming Lei) [RHEL-43782] {CVE-2022-48747} - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CKI Backport Bot) [RHEL-46913] {CVE-2024-39487} - net: fix __dst_negative_advice() race (Xin Long) [RHEL-41183] {CVE-2024-36971} - igc: avoid returning frame twice in XDP_REDIRECT (Corinna Vinschen) [RHEL-33264] {CVE-2024-26853} - mac802154: fix llsec key resources release in mac802154_llsec_key_del (Steve Best) [RHEL-34967] {CVE-2024-26961} - cpufreq: exit() callback is optional (Mark Langsdorf) [RHEL-43840] {CVE-2024-38615} - cifs: prevent infinite recursion in CIFSGetDFSRefer() (Paulo Alcantara) [RHEL-34672] - cifs: lock chan_lock outside match_session (Paulo Alcantara) [RHEL-34672] - smb3: workaround negprot bug in some Samba servers (Paulo Alcantara) [RHEL-34672] - smb3: use netname when available on secondary channels (Paulo Alcantara) [RHEL-34672] - smb3: fix empty netname context on secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: populate empty hostnames for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: always iterate smb sessions using primary channel (Paulo Alcantara) [RHEL-34672] - cifs: Fix connections leak when tlink setup failed (Paulo Alcantara) [RHEL-34672] - cifs: Fix memory leak when build ntlmssp negotiate blob failed (Paulo Alcantara) [RHEL-34672] - cifs: always initialize struct msghdr smb_msg completely (Paulo Alcantara) [RHEL-34672] - cifs: don't send down the destination address to sendmsg for a SOCK_STREAM (Paulo Alcantara) [RHEL-34672] - cifs: revalidate mapping when doing direct writes (Paulo Alcantara) [RHEL-34672] - cifs: skip extra NULL byte in filenames (Paulo Alcantara) [RHEL-34672] - cifs: list_for_each() -> list_for_each_entry() (Paulo Alcantara) [RHEL-34672] - smb2: small refactor in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - cifs: Fix crash on unload of cifs_arc4.ko (Paulo Alcantara) [RHEL-34672] - cifs: remove check of list iterator against head past the loop body (Paulo Alcantara) [RHEL-34672] - cifs: fix reconnect on smb3 mount types (Paulo Alcantara) [RHEL-34672] - cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (Paulo Alcantara) [RHEL-34672] - cifs: skip trailing separators of prefix paths (Paulo Alcantara) [RHEL-34672] - cifs: fix ntlmssp on old servers (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL ptr dereference in refresh_mounts() (Paulo Alcantara) [RHEL-34672] - cifs: do not skip link targets when an I/O fails (Paulo Alcantara) [RHEL-34672] - cifs: fix confusing unneeded warning message on smb2.1 and earlier (Paulo Alcantara) [RHEL-34672] - smb3: fix snapshot mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix workstation_name for multiuser mounts (Paulo Alcantara) [RHEL-34672] - cifs: alloc_path_with_tree_prefix: do not append sep. if the path is empty (Paulo Alcantara) [RHEL-34672] - cifs: free ntlmsspblob allocated in negotiate (Paulo Alcantara) [RHEL-34672] - cifs: avoid use of dstaddr as key for fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: add server conn_id to fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: fix missed refcounting of ipc tcon (Paulo Alcantara) [RHEL-34672] - smb2: clarify rc initialization in smb2_reconnect (Paulo Alcantara) [RHEL-34672] - cifs: populate server_hostname for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should be set on new server (Paulo Alcantara) [RHEL-34672] - cifs: introduce cifs_ses_mark_for_reconnect() helper (Paulo Alcantara) [RHEL-34672] - cifs: protect srv_count with cifs_tcp_ses_lock (Paulo Alcantara) [RHEL-34672] - cifs: move debug print out of spinlock (Paulo Alcantara) [RHEL-34672] - cifs: do not duplicate fscache cookie for secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: connect individual channel servers to primary channel server (Paulo Alcantara) [RHEL-34672] - cifs: protect session channel fields with chan_lock (Paulo Alcantara) [RHEL-34672] - cifs: do not negotiate session if session already exists (Paulo Alcantara) [RHEL-34672] - smb3: do not setup the fscache_super_cookie until fsinfo initialized (Paulo Alcantara) [RHEL-34672] - cifs: fix potential use-after-free bugs (Paulo Alcantara) [RHEL-34672] - cifs: release lock earlier in dequeue_mid error case (Paulo Alcantara) [RHEL-34672] - smb3: remove trivial dfs compile warning (Paulo Alcantara) [RHEL-34672] - cifs: support nested dfs links over reconnect (Paulo Alcantara) [RHEL-34672] - cifs: for compound requests, use open handle if possible (Paulo Alcantara) [RHEL-34672] - cifs: split out dfs code from cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant (Paulo Alcantara) [RHEL-34672] - cifs: introduce new helper for cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: fix print of hdr_flags in dfscache_proc_show() (Paulo Alcantara) [RHEL-34672] - cifs: send workstation name during ntlmssp session setup (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should not share socket with future sessions (Paulo Alcantara) [RHEL-34672] - smb3: add dynamic trace points for socket connection (Paulo Alcantara) [RHEL-34672] - cifs: Move SMB2_Create definitions to the shared area (Paulo Alcantara) [RHEL-34672] - cifs: Move more definitions into the shared area (Paulo Alcantara) [RHEL-34672] - cifs: move NEGOTIATE_PROTOCOL definitions out into the common area (Paulo Alcantara) [RHEL-34672] - cifs: Create a new shared file holding smb2 pdu definitions (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect check for null pointer in header_assemble (Paulo Alcantara) [RHEL-34672] - smb3: correct server pointer dereferencing check to be more consistent (Paulo Alcantara) [RHEL-34672] - cifs: Deal with some warnings from W=1 (Paulo Alcantara) [RHEL-34672] - cifs: fix a sign extension bug (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect kernel doc comments (Paulo Alcantara) [RHEL-34672] - cifs: remove pathname for file from SPDX header (Paulo Alcantara) [RHEL-34672] - cifs: move SMB FSCTL definitions to common code (Paulo Alcantara) [RHEL-34672] - cifs: rename cifs_common to smbfs_common (Paulo Alcantara) [RHEL-34672] - cifs: update FSCTL definitions (Paulo Alcantara) [RHEL-34672] - cifs: cifs_md4 convert to SPDX identifier (Paulo Alcantara) [RHEL-34672] - cifs: create a MD4 module and switch cifs.ko to use it (Paulo Alcantara) [RHEL-34672] - cifs: fork arc4 and create a separate module for it for cifs and other users (Paulo Alcantara) [RHEL-34672] - smb3: fix posix extensions mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix wrong release in sess_alloc_buffer() failed path (Paulo Alcantara) [RHEL-34672] - CIFS: Fix a potencially linear read overflow (Paulo Alcantara) [RHEL-34672] - cifs: use the correct max-length for dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: create sd context must be a multiple of 8 (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp sessions of dfs connections (Paulo Alcantara) [RHEL-34672] - cifs: added WARN_ON for all the count decrements (Paulo Alcantara) [RHEL-34672] - cifs: fix missing null session check in mount (Paulo Alcantara) [RHEL-34672] - cifs: handle reconnect of tcon when there is no cached dfs referral (Paulo Alcantara) [RHEL-34672] - cifs: fix the out of range assignment to bit fields in parse_server_interfaces (Paulo Alcantara) [RHEL-34672] - smb3: fix typo in header file (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: Add support for negotiating signing algorithm (Paulo Alcantara) [RHEL-34672] - cifs: prevent NULL deref in cifs_compose_mount_options() (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL dereference in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - smbdirect: missing rc checks while waiting for rdma events (Paulo Alcantara) [RHEL-34672] - cifs: Avoid field over-reading memcpy() (Paulo Alcantara) [RHEL-34672] - smb311: remove dead code for non compounded posix query info (Paulo Alcantara) [RHEL-34672] - cifs: fix SMB1 error path in cifs_get_file_info_unix (Paulo Alcantara) [RHEL-34672] - smb3: fix uninitialized value for port in witness protocol move (Paulo Alcantara) [RHEL-34672] - cifs: fix unneeded null check (Paulo Alcantara) [RHEL-34672] - cifs: use SPDX-Licence-Identifier (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in cifs_debug.c (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in smb2misc.c (Paulo Alcantara) [RHEL-34672] - cifs: missed ref-counting smb session in find (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp servers with dfs mounts (Paulo Alcantara) [RHEL-34672] - cifs: set a minimum of 2 minutes for refreshing dfs cache (Paulo Alcantara) [RHEL-34672] - cifs: Remove unused inline function is_sysvol_or_netlogon() (Paulo Alcantara) [RHEL-34672] - cifs: remove duplicated prototype (Paulo Alcantara) [RHEL-34672] - cifs: fix ipv6 formating in cifs_ses_add_channel (Paulo Alcantara) [RHEL-34672] - cifs: fix string declarations and assignments in tracepoints (Paulo Alcantara) [RHEL-34672] - cifs: fix memory leak in smb2_copychunk_range (Paulo Alcantara) [RHEL-34672] - SMB3: incorrect file id in requests compounded with open (Paulo Alcantara) [RHEL-34672] - smb3: if max_channels set to more than one channel request multichannel (Paulo Alcantara) [RHEL-34672] - smb3: do not attempt multichannel to server which does not support it (Paulo Alcantara) [RHEL-34672] - smb3: when mounting with multichannel include it in requested capabilities (Paulo Alcantara) [RHEL-34672] - cifs: simplify SWN code with dummy funcs instead of ifdefs (Paulo Alcantara) [RHEL-34672] - cifs: log mount errors using cifs_errorf() (Paulo Alcantara) [RHEL-34672] - cifs: switch build_path_from_dentry() to using dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: fix out-of-bound memory access when calling smb3_notify() at mount point (Paulo Alcantara) [RHEL-34672] - cifs: allocate buffer in the caller of build_path_from_dentry() (Paulo Alcantara) [RHEL-34672] - cifs: make build_path_from_dentry() return const char * (Paulo Alcantara) [RHEL-34672] - cifs: remove old dead code (Paulo Alcantara) [RHEL-34672] - fs: cifs: Remove repeated struct declaration (Paulo Alcantara) [RHEL-34672] - cifs: have cifs_fattr_to_inode() refuse to change type on live inode (Paulo Alcantara) [RHEL-34672] - cifs: have ->mkdir() handle race with another client sanely (Paulo Alcantara) [RHEL-34672] - do_cifs_create(): don't set ->i_mode of something we had not created (Paulo Alcantara) [RHEL-34672] - cifs: Silently ignore unknown oplock break handle (Paulo Alcantara) [RHEL-34672] - cifs: change noisy error message to FYI (Paulo Alcantara) [RHEL-34672] - cifs: print MIDs in decimal notation (Paulo Alcantara) [RHEL-34672] - cifs: minor simplification to smb2_is_network_name_deleted (Paulo Alcantara) [RHEL-34672] - TCON Reconnect during STATUS_NETWORK_NAME_DELETED (Paulo Alcantara) [RHEL-34672] - cifs: clarify hostname vs ip address in /proc/fs/cifs/DebugData (Paulo Alcantara) [RHEL-34672] - cifs: change confusing field serverName (to ip_addr) (Paulo Alcantara) [RHEL-34672] - cifs: Reformat DebugData and index connections by conn_id. (Paulo Alcantara) [RHEL-34672] - cifs: Identify a connection by a conn_id. (Paulo Alcantara) [RHEL-34672] - smb3: negotiate current dialect (SMB3.1.1) when version 3 or greater requested (Paulo Alcantara) [RHEL-34672] - smb3: Fix out-of-bounds bug in SMB2_negotiate() (Paulo Alcantara) [RHEL-34672] - fs/cifs: Simplify bool comparison. (Paulo Alcantara) [RHEL-34672] - fs/cifs: Assign boolean values to a bool variable (Paulo Alcantara) [RHEL-34672] - cifs: Avoid error pointer dereference (Paulo Alcantara) [RHEL-34672] - cifs: Re-indent cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Unlock on errors in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Delete a stray unlock in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Tracepoints and logs for tracing credit changes. (Paulo Alcantara) [RHEL-34672] - cifs: Fix some error pointers handling detected by static checker (Paulo Alcantara) [RHEL-34672] - smb3: remind users that witness protocol is experimental (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: do not log warning message if server doesn't populate salt (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: update comments clarifying SPNEGO info in negprot response (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot rsp (Paulo Alcantara) [RHEL-34672] - SMB3: avoid confusing warning message on mount to Azure (Paulo Alcantara) [RHEL-34672] - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (Nigel Croxon) [RHEL-46662] {CVE-2024-39476} - net: fix information leakage in /proc/net/ptype (Hangbin Liu) [RHEL-44000] {CVE-2022-48757} - usb: typec: ucsi: Limit read size on v1.2 (Desnes Nunes) [RHEL-37286] {CVE-2024-35924} - minmax: relax check to allow comparison between unsigned arguments and signed constants (Desnes Nunes) [RHEL-37286] - minmax: allow comparisons of 'int' against 'unsigned char/short' (Desnes Nunes) [RHEL-37286] - minmax: allow min()/max()/clamp() if the arguments have the same signedness. (Desnes Nunes) [RHEL-37286] - minmax: add umin(a, b) and umax(a, b) (Desnes Nunes) [RHEL-37286] - minmax: fix header inclusions (Desnes Nunes) [RHEL-37286] - minmax: clamp more efficiently by avoiding extra comparison (Desnes Nunes) [RHEL-37286] - minmax: sanity check constant bounds when clamping (Desnes Nunes) [RHEL-37286] - tracing: Define the is_signed_type() macro once (Desnes Nunes) [RHEL-37286] - linux/bits.h: fix compilation error with GENMASK (Desnes Nunes) [RHEL-37286] - x86/apic: Mask IOAPIC entries when disabling the local APIC (Lenny Szubowicz) [RHEL-18077] - userfaultfd: fix a race between writeprotect and exit_mmap() (Rafael Aquini) [RHEL-38410] {CVE-2021-47461} - mm: khugepaged: skip huge page collapse for special files (Waiman Long) [RHEL-38446] {CVE-2021-47491} - cachefiles: fix memory leak in cachefiles_add_cache() (Andrey Albershteyn) [RHEL-33109] {CVE-2024-26840} - drm/amd/display: Implement bounds check for stream encoder creation in DCN301 (Michel Dänzer) [RHEL-31429] {CVE-2024-26660} - net/mlx5: Discard command completions in internal error (Kamal Heib) [RHEL-44231] {CVE-2024-38555} - drm: Don't unref the same fb many times by mistake due to deadlock handling (CKI Backport Bot) [RHEL-29011] {CVE-2023-52486} - md: fix resync softlockup when bitmap size is less than array size (Nigel Croxon) [RHEL-43942] {CVE-2024-38598} - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation (Davide Caratti) [RHEL-39712] {CVE-2024-36017} - netfilter: nf_tables: discard table flag update with pending basechain deletion (Phil Sutter) [RHEL-37205] {CVE-2024-35897} - netfilter: nf_tables: reject table flag and netdev basechain updates (Phil Sutter) [RHEL-37205] - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (Ewan D. Milne) [RHEL-40172] {CVE-2024-36924} - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (Ewan D. Milne) [RHEL-40172] {CVE-2024-36952} - netfilter: nf_tables: fix memleak in map from abort path (Phil Sutter) [RHEL-35052] {CVE-2024-27011} - netfilter: nf_tables: reject new basechain after table flag update (Phil Sutter) [RHEL-37193] {CVE-2024-35900} - netfilter: nf_tables: flush pending destroy work before exit_net release (Phil Sutter) [RHEL-37197] {CVE-2024-35899} - netfilter: complete validation of user input (Phil Sutter) [RHEL-37210] - netfilter: validate user input for expected length (Phil Sutter) [RHEL-37210] {CVE-2024-35896} - netfilter: tproxy: bail out if IP has been disabled on the device (Phil Sutter) [RHEL-44363] {CVE-2024-36270} - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (Phil Sutter) [RHEL-44532] {CVE-2024-36286} - netfilter: nf_tables: do not compare internal table flags on updates (Phil Sutter) [RHEL-35114] {CVE-2024-27065} - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (Phil Sutter) [RHEL-35028] {CVE-2024-27019} - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (Phil Sutter) [RHEL-35024] {CVE-2024-27020} - netfilter: nf_tables: __nft_expr_type_get() selects specific family type (Phil Sutter) [RHEL-35024] - netfilter: conntrack: serialize hash resizes and cleanups (Phil Sutter) [RHEL-37703] {CVE-2021-47408} - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (Phil Sutter) [RHEL-34217] {CVE-2024-26925} - netfilter: nf_tables: release batch on table validation from abort path (Phil Sutter) [RHEL-34217] - ipvlan: add ipvlan_route_v6_outbound() helper (Davide Caratti) [RHEL-38319] {CVE-2023-52796} - [rt] build kernel-rt-4.18.0-553.12.1.rt7.353.el8_10 [RHEL-44553] - net: bridge: xmit: make sure we have at least eth header len bytes (cki-backport-bot) [RHEL-44291] {CVE-2024-38538} - drivers/amd/pm: fix a use-after-free in kv_parse_power_table (Michel Dänzer) [RHEL-26893] {CVE-2023-52469} - SUNRPC: Fix a suspicious RCU usage warning (Scott Mayhew) [RHEL-30503] {CVE-2023-52623} - ice: Fix some null pointer dereference issues in ice_ptp.c (Petr Oros) [RHEL-26901] {CVE-2023-52471} - xfs: fix internal error from AGFL exhaustion (Pavel Reichl) [RHEL-45581] - sched/psi: Fix use-after-free in ep_remove_wait_queue() (Phil Auld) [RHEL-38117] {CVE-2023-52707} - wait: add wake_up_pollfree() (Phil Auld) [RHEL-38117] - net/ipv6: avoid possible UAF in ip6_route_mpath_notify() (Hangbin Liu) [RHEL-33269] {CVE-2024-26852} - net: bridge: switchdev: Skip MDB replays of deferred events on offload (Ivan Vecera) [RHEL-33117] {CVE-2024-26837} - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (Pavel Reichl) [RHEL-31700] {CVE-2024-26772} - ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() (Pavel Reichl) [RHEL-31688] {CVE-2024-26773} - ext4: fix double-free of blocks due to wrong extents moved_len (Pavel Reichl) [RHEL-31612] {CVE-2024-26704} - vxlan: Pull inner IP header in vxlan_xmit_one(). (Guillaume Nault) [RHEL-31389] - geneve: Fix incorrect inner network header offset when innerprotoinherit is set (Guillaume Nault) [RHEL-31389] - vxlan: Pull inner IP header in vxlan_rcv(). (Guillaume Nault) [RHEL-31389] - geneve: fix header validation in geneve[6]_xmit_skb (Guillaume Nault) [RHEL-31389] - geneve: make sure to pull inner header in geneve_rx() (Guillaume Nault) [RHEL-31389] - net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb (Guillaume Nault) [RHEL-31389] - net: geneve: check skb is large enough for IPv4/IPv6 header (Guillaume Nault) [RHEL-31389] - net/smc: fix neighbour and rtable leak in smc_ib_find_route() (Tobias Huschle) [RHEL-39744] {CVE-2024-36945} - igb: Fix string truncation warnings in igb_set_fw_version (Corinna Vinschen) [RHEL-38452] {CVE-2024-36010} - bonding: stop the device in bond_setup_by_slave() (Hangbin Liu) [RHEL-38327] {CVE-2023-52784} - i40e: fix vf may be used uninitialized in this function warning (Kamal Heib) [RHEL-39702] {CVE-2024-36020} - powerpc/64: Fix the definition of the fixmap area (Mamatha Inamdar) [RHEL-27191] {CVE-2021-47018} - powerpc/mm/hash64: Add a variable to track the end of IO mapping (Mamatha Inamdar) [RHEL-27191] {CVE-2021-47018} - nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). (Xin Long) [RHEL-39770] {CVE-2024-36933} - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (Xin Long) [RHEL-39770] - net: core: reject skb_copy(_expand) for fraglist GSO skbs (Xin Long) [RHEL-39779] {CVE-2024-36929} - tcp: properly terminate timers for kernel sockets (Guillaume Nault) [RHEL-37171] {CVE-2024-35910} - net: relax socket state check at accept time. (Florian Westphal) [RHEL-39831] - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (Florian Westphal) [RHEL-39831] {CVE-2024-36905} - tcp: remove redundant check on tskb (Florian Westphal) [RHEL-39831] - drm/ast: Fix soft lockup (cki-backport-bot) [RHEL-37438] {CVE-2024-35952} - null_blk: Fix return value of nullb_device_power_store() (Ming Lei) [RHEL-39341] - null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues' (Ming Lei) [RHEL-39341] - null_blk: fix return value from null_add_dev() (Ming Lei) [RHEL-39341] - [rt] build kernel-rt-4.18.0-553.11.1.rt7.352.el8_10 [RHEL-44553] - x86/bugs: Reverse instruction order of CLEAR_CPU_BUFFERS (Waiman Long) [RHEL-42121] - Revert "x86/bugs: Use fixed addressing for VERW operand" (Waiman Long) [RHEL-42121] - KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests (Waiman Long) [RHEL-42121] - x86/rfds: Mitigate Register File Data Sampling (RFDS) (Waiman Long) [RHEL-42121] - Documentation/hw-vuln: Add documentation for RFDS (Waiman Long) [RHEL-42121] - x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set (Waiman Long) [RHEL-42121] - x86/bugs: Use fixed addressing for VERW operand (Waiman Long) [RHEL-42121] - KVM/VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH (Waiman Long) [RHEL-42121] - x86/bugs: Use ALTERNATIVE() instead of mds_user_clear static key (Waiman Long) [RHEL-42121] - x86/entry_32: Add VERW just before userspace transition (Waiman Long) [RHEL-42121] - x86/entry_64: Add VERW just before userspace transition (Waiman Long) [RHEL-42121] - x86/bugs: Add asm helpers for executing VERW (Waiman Long) [RHEL-42121] - x86/cpu: Fix Gracemont uarch (Waiman Long) [RHEL-42121] - Documentation/hw-vuln: Unify filename specification in index (Waiman Long) [RHEL-42121] - KVM: VMX: Access @flags as a 32-bit value in __vmx_vcpu_run() (Waiman Long) [RHEL-42121] - x86/asm: Add _ASM_RIP() macro for x86-64 (%rip) suffix (Waiman Long) [RHEL-42121] - x86/asm: Have the __ASM_FORM macros handle commas in arguments (Waiman Long) [RHEL-42121] - x86/asm: Allow to pass macros to __ASM_FORM() (Waiman Long) [RHEL-42121] - wifi: iwlwifi: mvm: guard against invalid STA ID on removal (Jose Ignacio Tornos Martinez) [RHEL-39801] {CVE-2024-36921} - ipv6: Fix potential uninit-value access in __ip6_make_skb() (Antoine Tenart) [RHEL-39784] - ipv4: Fix uninit-value access in __ip_make_skb() (Antoine Tenart) [RHEL-39784] {CVE-2024-36927} - perf mmap: Lazily initialize zstd streams to save memory when not using it (Michael Petlan) [RHEL-34876] - perf tools: Fix spelling mistake "commpressor" -> "compressor" (Michael Petlan) [RHEL-34876] - perf record: Introduce data transferred and compressed stats (Michael Petlan) [RHEL-34876] - perf record: Introduce compressor at mmap buffer object (Michael Petlan) [RHEL-34876] - perf record: Introduce bytes written stats (Michael Petlan) [RHEL-34876] - perf record: Introduce data file at mmap buffer object (Michael Petlan) [RHEL-34876] - perf record: Start threads in the beginning of trace streaming (Alexey Bayduraev) [RHEL-34876] - perf record: Stop threads in the end of trace streaming (Michael Petlan) [RHEL-34876] - perf record: Introduce thread local variable (Michael Petlan) [RHEL-34876] - perf record: Introduce function to propagate control commands (Michael Petlan) [RHEL-34876] - perf record: Introduce thread specific data array (Michael Petlan) [RHEL-34876] - tools lib: Introduce fdarray duplicate function (Michael Petlan) [RHEL-34876] - perf record: Introduce thread affinity and mmap masks (Michael Petlan) [RHEL-34876] - gfs2: Be more careful with the quota sync generation (Andreas Gruenbacher) [RHEL-40901] - gfs2: Get rid of some unnecessary quota locking (Andreas Gruenbacher) [RHEL-40901] - gfs2: Add some missing quota locking (Andreas Gruenbacher) [RHEL-40901] - gfs2: Fold qd_fish into gfs2_quota_sync (Andreas Gruenbacher) [RHEL-40901] - gfs2: quota need_sync cleanup (Andreas Gruenbacher) [RHEL-40901] - gfs2: Fix and clean up function do_qc (Andreas Gruenbacher) [RHEL-40901] - gfs2: Revert "Add quota_change type" (Andreas Gruenbacher) [RHEL-40901] - gfs2: Revert "ignore negated quota changes" (Andreas Gruenbacher) [RHEL-40901] - gfs2: qd_check_sync cleanups (Andreas Gruenbacher) [RHEL-40901] - gfs2: Check quota consistency on mount (Andreas Gruenbacher) [RHEL-40901] - gfs2: Minor gfs2_quota_init error path cleanup (Andreas Gruenbacher) [RHEL-40901] - gfs2: fix kernel BUG in gfs2_quota_cleanup (Edward Adam Davis) [RHEL-40901] - gfs2: Clean up quota.c:print_message (Andreas Gruenbacher) [RHEL-40901] - gfs2: Clean up gfs2_alloc_parms initializers (Andreas Gruenbacher) [RHEL-40901] - gfs2: Two quota=account mode fixes (Andreas Gruenbacher) [RHEL-40901] - gfs2: Remove useless assignment (Bob Peterson) [RHEL-40901] - gfs2: simplify slot_get (Bob Peterson) [RHEL-40901] - gfs2: Simplify qd2offset (Bob Peterson) [RHEL-40901] - gfs2: Remove quota allocation info from quota file (Bob Peterson) [RHEL-40901] - gfs2: use constant for array size (Bob Peterson) [RHEL-40901] - gfs2: Set qd_sync_gen in do_sync (Bob Peterson) [RHEL-40901] - gfs2: Remove useless err set (Bob Peterson) [RHEL-40901] - gfs2: Small gfs2_quota_lock cleanup (Bob Peterson) [RHEL-40901] - gfs2: move qdsb_put and reduce redundancy (Bob Peterson) [RHEL-40901] - gfs2: Don't try to sync non-changes (Bob Peterson) [RHEL-40901] - gfs2: Simplify function need_sync (Bob Peterson) [RHEL-40901] - gfs2: remove unneeded pg_oflow variable (Bob Peterson) [RHEL-40901] - gfs2: remove unneeded variable done (Bob Peterson) [RHEL-40901] - gfs2: pass sdp to gfs2_write_buf_to_page (Bob Peterson) [RHEL-40901] - gfs2: pass sdp in to gfs2_write_disk_quota (Bob Peterson) [RHEL-40901] - gfs2: Pass sdp to gfs2_adjust_quota (Bob Peterson) [RHEL-40901] - gfs2: remove dead code for quota writes (Bob Peterson) [RHEL-40901] - gfs2: Use qd_sbd more consequently (Bob Peterson) [RHEL-40901] - gfs2: replace 'found' with dedicated list iterator variable (Jakob Koschel) [RHEL-40901] - gfs2: Some whitespace cleanups (Andreas Gruenbacher) [RHEL-40901] - gfs2: Fix gfs2_qa_get imbalance in gfs2_quota_hold (Bob Peterson) [RHEL-40901] - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg (Guillaume Nault) [RHEL-43961] {CVE-2024-38596} - af_unix: Fix data-races around sk->sk_shutdown. (Guillaume Nault) [RHEL-43961] {CVE-2024-38596} - af_unix: Fix data races around sk->sk_shutdown. (Guillaume Nault) [RHEL-43961] {CVE-2024-38596} - perf/core: Fix event sibling list locking (Daniel Vacek) [RHEL-31798] - media: bttv: fix use after free error due to btv->timeout timer (Kate Hsuan) [RHEL-38256] {CVE-2023-52847} - arp: Prevent overflow in arp_req_get(). (Antoine Tenart) [RHEL-31706] {CVE-2024-26733} - Bluetooth: btusb: Add a new PID/VID 0489/e0c8 for MT7921 (David Marlin) [RHEL-10263] - mm: swap: fix race between free_swap_and_cache() and swapoff() (Waiman Long) [RHEL-34971] {CVE-2024-26960} - swap: comments get_swap_device() with usage rule (Waiman Long) [RHEL-34971] {CVE-2024-26960} - mm/swapfile.c: __swap_entry_free() always free 1 entry (Waiman Long) [RHEL-34971] {CVE-2024-26960} - mm/swapfile.c: call free_swap_slot() in __swap_entry_free() (Waiman Long) [RHEL-34971] {CVE-2024-26960} - mm/swapfile.c: use __try_to_reclaim_swap() in free_swap_and_cache() (Waiman Long) [RHEL-34971] {CVE-2024-26960} - net: amd-xgbe: Fix skb data length underflow (Ken Cox) [RHEL-43788] {CVE-2022-48743} - ovl: fix warning in ovl_create_real() (cki-backport-bot) [RHEL-43652] {CVE-2021-47579} - net/sched: initialize noop_qdisc owner (Davide Caratti) [RHEL-35056] - net/sched: Fix mirred deadlock on device recursion (Davide Caratti) [RHEL-35056] {CVE-2024-27010} - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (Pavel Reichl) [RHEL-45029] {CVE-2024-39276} - ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() (Ken Cox) [RHEL-38713] {CVE-2021-47548} - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound (Hangbin Liu) [RHEL-44396] {CVE-2024-33621} - mlxsw: spectrum_acl_tcam: Fix stack corruption (Ivan Vecera) [RHEL-26462] {CVE-2024-26586} - inet: inet_defrag: prevent sk release while still in use (Antoine Tenart) [RHEL-33398] {CVE-2024-26921} - skb_expand_head() adjust skb->truesize incorrectly (Antoine Tenart) [RHEL-33398] - nvmet: fix ns enable/disable possible hang (Ming Lei) [RHEL-43547] - [rt] build kernel-rt-4.18.0-553.10.1.rt7.351.el8_10 [RHEL-44553] - SUNRPC: Fix RPC client cleaned up the freed pipefs dentries (Scott Mayhew) [RHEL-38264] {CVE-2023-52803} - scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() (Ewan D. Milne) [RHEL-39717] {CVE-2024-36025} - tcp: add sanity checks to rx zerocopy (Guillaume Nault) [RHEL-29494] {CVE-2024-26640} - SUNRPC: fix some memleaks in gssx_dec_option_array (Scott Mayhew) [RHEL-35209] {CVE-2024-27388} - wifi: nl80211: don't free NULL coalescing rule (Jose Ignacio Tornos Martinez) [RHEL-39752] {CVE-2024-36941} - nfs: fix UAF in direct writes (Scott Mayhew) [RHEL-34975] {CVE-2024-26958} - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 (Scott Mayhew) [RHEL-33228] {CVE-2024-26870} - drm/amd/pm: Fix error of MACO flag setting code (Michel Dänzer) [RHEL-15928] - scsi: aacraid: fix io hangs and improve performance (John Meneghini) [RHEL-23913] - block: prevent division by zero in blk_rq_stat_sum() (Ming Lei) [RHEL-37279] {CVE-2024-35925} - block: fix overflow in blk_ioctl_discard() (Ming Lei) [RHEL-39811] {CVE-2024-36917} - virtio-blk: fix implicit overflow on virtio_max_dma_size (Ming Lei) [RHEL-38131] {CVE-2023-52762} - nbd: null check for nla_nest_start (Ming Lei) [RHEL-35176] {CVE-2024-27025} - isdn: mISDN: netjet: Fix crash in nj_probe: (Ken Cox) [RHEL-38444] {CVE-2021-47284} - isdn: mISDN: Fix sleeping function called from invalid context (Ken Cox) [RHEL-38400] {CVE-2021-47468} - net/smc: avoid data corruption caused by decline (Tobias Huschle) [RHEL-38234] {CVE-2023-52775} - ubi: Check for too small LEB size in VTBL code (David Arcari) [RHEL-25092] {CVE-2024-25739} - i2c: core: Fix atomic xfer check for non-preempt config (Steve Best) [RHEL-38313] {CVE-2023-52791} - i2c: core: Run atomic i2c xfer when !preemptible (Steve Best) [RHEL-38313] {CVE-2023-52791} - firewire: ohci: mask bus reset interrupts between ISR and bottom half (Steve Best) [RHEL-39902] {CVE-2024-36950} - ipv6: init the accept_queue's spinlocks in inet6_create (Guillaume Nault) [RHEL-28899] {CVE-2024-26614} - tcp: make sure init the accept_queue's spinlocks once (Guillaume Nault) [RHEL-28899] {CVE-2024-26614} - tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (Steve Best) [RHEL-39352] {CVE-2024-36016} - mlxsw: spectrum_acl_tcam: Fix incorrect list API usage (Ivan Vecera) [RHEL-37484] {CVE-2024-36006} - pwm: Fix double shift bug (Steve Best) [RHEL-38278] {CVE-2023-52756} - mmc: sdio: fix possible resource leaks in some error paths (Steve Best) [RHEL-38149] {CVE-2023-52730} - of: unittest: Fix compile in the non-dynamic case (Steve Best) [RHEL-37070] {CVE-2023-52679} - of: unittest: Fix of_count_phandle_with_args() expected value message (Steve Best) [RHEL-37070] {CVE-2023-52679} - of: Fix double free in of_parse_phandle_with_args_map (Steve Best) [RHEL-37070] {CVE-2023-52679} - pinctrl: core: delete incorrect free in pinctrl_enable() (Steve Best) [RHEL-39756] {CVE-2024-36940} - pinctrl: core: fix possible memory leak in pinctrl_enable() (Steve Best) [RHEL-39756] {CVE-2024-36940} - media: gspca: cpia1: shift-out-of-bounds in set_flicker (Desnes Nunes) [RHEL-38331] {CVE-2023-52764} - tipc: fix a possible memleak in tipc_buf_append (Xin Long) [RHEL-39881] {CVE-2024-36954} - cifs: fix mid leak during reconnection after timeout threshold (Paulo Alcantara) [RHEL-36222] - cifs: Fix use-after-free in rdata->read_into_pages() (Paulo Alcantara) [RHEL-36222] - cifs: Fix pages leak when writedata alloc failed in cifs_write_from_iter() (Paulo Alcantara) [RHEL-36222] - cifs: Fix pages array leak when writedata alloc failed in cifs_writedata_alloc() (Paulo Alcantara) [RHEL-36222] - cifs: destage dirty pages before re-reading them for cache=none (Paulo Alcantara) [RHEL-36222] - cifs: destage any unwritten data to the server before calling copychunk_write (Paulo Alcantara) [RHEL-36222] - Adjust cifssb maximum read size (Paulo Alcantara) [RHEL-36222] - cifs: make locking consistent around the server session status (Paulo Alcantara) [RHEL-36222] - cifs: fix credit accounting for extra channel (Paulo Alcantara) [RHEL-36222] - smb3: prevent races updating CurrentMid (Paulo Alcantara) [RHEL-36222] - cifs: fix missing spinlock around update to ses->status (Paulo Alcantara) [RHEL-36222] - cifs: use echo_interval even when connection not ready. (Paulo Alcantara) [RHEL-36222] - cifs: detect dead connections only when echoes are enabled. (Paulo Alcantara) [RHEL-36222] - cifs: Fix preauth hash corruption (Paulo Alcantara) [RHEL-36222] - cifs: do not send close in compound create+close requests (Paulo Alcantara) [RHEL-36222] - cifs: ask for more credit on async read/write code paths (Paulo Alcantara) [RHEL-36222] - cifs: use discard iterator to discard unneeded network data more efficiently (Paulo Alcantara) [RHEL-36222] - cifs: Fix in error types returned for out-of-credit situations. (Paulo Alcantara) [RHEL-36222] - smb3: fix crediting for compounding when only one request in flight (Paulo Alcantara) [RHEL-36222] - cifs: New optype for session operations. (Paulo Alcantara) [RHEL-36222] - mm/gup: do not return 0 from pin_user_pages_fast() for bad args (Paulo Alcantara) [RHEL-36222] - wifi: brcmfmac: pcie: handle randbuf allocation failure (Jose Ignacio Tornos Martinez) [RHEL-44124] {CVE-2024-38575} - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). (Guillaume Nault) [RHEL-39835] {CVE-2024-36904} - wifi: mac80211: don't return unset power in ieee80211_get_tx_power() (Jose Ignacio Tornos Martinez) [RHEL-38159] {CVE-2023-52832} - wifi: ath11k: fix gtk offload status event locking (Jose Ignacio Tornos Martinez) [RHEL-38155] {CVE-2023-52777} - net: ieee802154: fix null deref in parse dev addr (Steve Best) [RHEL-38012] {CVE-2021-47257} - mm/hugetlb: fix missing hugetlb_lock for resv uncharge (Rafael Aquini) [RHEL-37465] {CVE-2024-36000} - x86/xen: Add some null pointer checking to smp.c (Vitaly Kuznetsov) [RHEL-33258] {CVE-2024-26908} - x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() (Vitaly Kuznetsov) [RHEL-33258] {CVE-2024-26908} - wifi: cfg80211: check A-MSDU format more carefully (Jose Ignacio Tornos Martinez) [RHEL-37343] {CVE-2024-35937} - wifi: rtw89: fix null pointer access when abort scan (Jose Ignacio Tornos Martinez) [RHEL-37355] {CVE-2024-35946} - atl1c: Work around the DMA RX overflow issue (Ken Cox) [RHEL-38287] {CVE-2023-52834} - wifi: ath11k: decrease MHI channel buffer length to 8KB (Jose Ignacio Tornos Martinez) [RHEL-37339] {CVE-2024-35938} - wifi: iwlwifi: mvm: rfi: fix potential response leaks (Jose Ignacio Tornos Martinez) [RHEL-37163] {CVE-2024-35912} - USB: core: Fix access violation during port device removal (Desnes Nunes) [RHEL-39853] {CVE-2024-36896} - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() (Ewan D. Milne) [RHEL-37123] {CVE-2024-35930} - netfilter: nf_tables: honor table dormant flag from netdev release event path (Phil Sutter) [RHEL-37450] {CVE-2024-36005} - wifi: iwlwifi: mvm: don't set the MFP flag for the GTK (Jose Ignacio Tornos Martinez) [RHEL-36898] {CVE-2024-27434} - wifi: iwlwifi: mvm: Fix key flags for IGTK on AP interface (Jose Ignacio Tornos Martinez) [RHEL-36898] {CVE-2024-27434} - misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspend/resume (Steve Best) [RHEL-36932] {CVE-2024-35824} - [rt] build kernel-rt-4.18.0-553.9.1.rt7.350.el8_10 [RHEL-44553] - x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (Steve Best) [RHEL-37262] {CVE-2024-35876} - net/sched: flower: Fix chain template offload (Xin Long) [RHEL-31313] {CVE-2024-26669} - SUNRPC: fix a memleak in gss_import_v2_context (Scott Mayhew) [RHEL-35195] {CVE-2023-52653} - efivarfs: force RO when remounting if SetVariable is not supported (Pavel Reichl) [RHEL-26564] {CVE-2023-52463} - dmaengine: idxd: add a write() method for applications to submit work (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823} - dmaengine: idxd: add a new security check to deal with a hardware erratum (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823} - VFIO: Add the SPR_DSA and SPR_IAX devices to the denylist (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823} - quota: Fix potential NULL pointer dereference (Pavel Reichl) [RHEL-33219] {CVE-2024-26878} - locking/lockdep: Fix overflow in presentation of average lock-time (Čestmír Kalina) [RHEL-17678] - blk-cgroup: Properly propagate the iostat update up the hierarchy (Ming Lei) [RHEL-40939] - proc: Use new_inode not new_inode_pseudo (Ian Kent) [RHEL-40167] - stmmac: Clear variable when destroying workqueue (Izabela Bakollari) [RHEL-31822] {CVE-2024-26802} - powerpc/pseries/memhp: Fix access beyond end of drmem array (Mamatha Inamdar) [RHEL-26495] {CVE-2023-52451} - platform/x86: wmi: Fix opening of char device (David Arcari) [RHEL-38258] {CVE-2023-52864} - Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" (Kamal Heib) [RHEL-36908] {CVE-2023-52658} - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed (Cathy Avery) [RHEL-39074] - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove (Cathy Avery) [RHEL-39074] - hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes (Cathy Avery) [RHEL-39074] - hv_netvsc: remove duplicated including of slab.h (Cathy Avery) [RHEL-39074] - hv_netvsc: rndis_filter needs to select NLS (Cathy Avery) [RHEL-39074] - hv_netvsc: Mark VF as slave before exposing it to user-mode (Cathy Avery) [RHEL-39074] - hv_netvsc: Fix race of register_netdevice_notifier and VF register (Cathy Avery) [RHEL-39074] - hv_netvsc: fix race of netvsc and VF register_netdevice (Cathy Avery) [RHEL-39074] - hv_netvsc: fix netvsc_send_completion to avoid multiple message length checks (Cathy Avery) [RHEL-39074] - hv_netvsc: Allocate rx indirection table size dynamically (Cathy Avery) [RHEL-39074] - net: hv_netvsc: Fix a warning triggered by memcpy in rndis_filter (Cathy Avery) [RHEL-39074] - gfs2: Fix lru_count accounting (Andreas Gruenbacher) [RHEL-32941] - gfs2: Fix "Make glock lru list scanning safer" (Andreas Gruenbacher) [RHEL-32941] - gfs2: Fix "ignore unlock failures after withdraw" (Andreas Gruenbacher) [RHEL-32941] - gfs2: Don't set GLF_LOCK in gfs2_dispose_glock_lru (Andreas Gruenbacher) [RHEL-32941] - gfs2: Don't forget to complete delayed withdraw (Andreas Gruenbacher) [RHEL-32941] - gfs2: Delay withdraw from atomic context (Andreas Gruenbacher) [RHEL-32941] - gfs2: trivial clean up of gfs2_ail_error (Andreas Gruenbacher) [RHEL-32941] - ext4: fix corruption during on-line resize (Carlos Maiolino) [RHEL-36974] {CVE-2024-35807} - ext4: correct offset of gdb backup in non meta_bg group to update_backups (Carlos Maiolino) [RHEL-36974] - ext4: avoid online resizing failures due to oversized flex bg (Carlos Maiolino) [RHEL-30507] {CVE-2023-52622} - ext4: use time_is_before_jiffies() instead of open coding it (Carlos Maiolino) [RHEL-30507] - ext4: unify the type of flexbg_size to unsigned int (Carlos Maiolino) [RHEL-30507] - ext4: remove unnecessary check from alloc_flex_gd() (Carlos Maiolino) [RHEL-30507] - tracing: Do no increment trace_clock_global() by one (Jerome Marchand) [RHEL-27107] {CVE-2021-46939} - tracing: Restructure trace_clock_global() to never block (Jerome Marchand) [RHEL-27107] {CVE-2021-46939} - net/sched: act_skbmod: prevent kernel-infoleak (Xin Long) [RHEL-37220] {CVE-2024-35893} - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (Xin Long) [RHEL-38307] {CVE-2023-52845} - redhat: remove the merge subtrees script (Derek Barbosa) - redhat: rhdocs: delete .get_maintainer.conf (Derek Barbosa) - redhat: rhdocs: Remove the rhdocs directory (Derek Barbosa) - dyndbg: fix old BUG_ON in >control parser (Waiman Long) [RHEL-37111] {CVE-2024-35947} - dyndbg: let query-modname override actual module name (Waiman Long) [RHEL-37111] - dyndbg: make dyndbg a known cli param (Waiman Long) [RHEL-37111] - lan78xx: Fix exception on link speed change (Jamie Bainbridge) [RHEL-33437] - net: usb: lan78xx: don't modify phy_device state concurrently (Jamie Bainbridge) [RHEL-33437] - efi: runtime: Fix potential overflow of soft-reserved region size (Lenny Szubowicz) [RHEL-33096] {CVE-2024-26843} - perf/arm-cmn: Fail DTC counter allocation correctly (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Rework DTC counters (again) (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Fix DTC domain detection (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Revamp model detection (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Fix port detection for CMN-700 (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Move overlapping wp_combine field (Michael Petlan) [RHEL-23841] - Partially revert "perf/arm-cmn: Optimise DTC counter accesses" (Michael Petlan) [RHEL-23841] - drivers/perf: Compile with gnu99 standard (Michael Petlan) [RHEL-23841] - x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (Steve Best) [RHEL-36994] {CVE-2024-35801} - watchdog: softdog: Add options 'soft_reboot_cmd' and 'soft_active_on_boot' (Waiman Long) [RHEL-19723] - tipc: fix UAF in error path (Xin Long) [RHEL-34278] {CVE-2024-36886} - [rt] build kernel-rt-4.18.0-553.8.1.rt7.349.el8_10 [RHEL-40882] - udf: Fix NULL pointer dereference in udf_symlink function (Pavel Reichl) [RHEL-37769] {CVE-2021-47353} - net: ti: fix UAF in tlan_remove_one (Jose Ignacio Tornos Martinez) [RHEL-38940] {CVE-2021-47310} - ARM: footbridge: fix PCI interrupt mapping (Myron Stowe) [RHEL-26971] {CVE-2021-46909} - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (Kamal Heib) [RHEL-37454] {CVE-2024-36004} - net/mlx5e: Fix mlx5e_priv_init() cleanup flow (Kamal Heib) [RHEL-37424] {CVE-2024-35959} - net/mlx5: Properly link new fs rules into the tree (Kamal Heib) [RHEL-37420] {CVE-2024-35960} - net/mlx5e: fix a potential double-free in fs_any_create_groups (Kamal Heib) [RHEL-37091] {CVE-2023-52667} - net: ena: Fix incorrect descriptor free behavior (Kamal Heib) [RHEL-37428] {CVE-2024-35958} - mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - mISDN: fix possible use-after-free in HFC_cleanup() (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - implement dh fallback for primes > 4K (Vladis Dronov) [RHEL-35106] - crypto: qat - avoid division by zero (Vladis Dronov) [RHEL-35106] - crypto: qat - resolve race condition during AER recovery (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - use kcalloc_node() instead of kzalloc_node() (Vladis Dronov) [RHEL-35106] - [rt] Enable CONFIG_DRM_MGAG200_DISABLE_WRITECOMBINE (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Add an option to disable Write-Combine (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Fix caching setup for remapped video memory (Jocelyn Falempe) [RHEL-36172] - Revert "drm/mgag200: Add a workaround for low-latency" (Jocelyn Falempe) [RHEL-36172] - mptcp: fix data re-injection from stale subflow (Davide Caratti) [RHEL-33133] {CVE-2024-26826} - ipv6: sr: fix incorrect unregister order (Hangbin Liu) [RHEL-31730] - ipv6: sr: fix possible use-after-free and null-ptr-deref (Hangbin Liu) [RHEL-31730] {CVE-2024-26735} - net/bnx2x: Prevent access to a freed page in page_pool (Michal Schmidt) [RHEL-14195 RHEL-33243] {CVE-2024-26859} - bnx2x: new flag for track HW resource allocation (Michal Schmidt) [RHEL-14195 RHEL-33243] - bnx2x: fix page fault following EEH recovery (Michal Schmidt) [RHEL-14195 RHEL-33243] - x86: KVM: SVM: always update the x2avic msr interception (Maxim Levitsky) [RHEL-15495] {CVE-2023-5090} - EDAC/thunderx: Fix possible out-of-bounds string access (Aristeu Rozanski) [RHEL-26573] {CVE-2023-52464} - [rt] build kernel-rt-4.18.0-553.7.1.rt7.348.el8_10 [RHEL-34640] - net: qcom/emac: fix UAF in emac_remove (Ken Cox) [RHEL-37834] {CVE-2021-47311} - perf/core: Bail out early if the request AUX area is out of bound (Michael Petlan) [RHEL-38268] {CVE-2023-52835} - crypto: pcrypt - Fix hungtask for PADATA_RESET (Herbert Xu) [RHEL-38171] {CVE-2023-52813} - drm/amdgpu: fix use-after-free bug (Jocelyn Falempe) [RHEL-31240] {CVE-2024-26656} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash (Ivan Vecera) [RHEL-37008] {CVE-2024-35854} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update (Ivan Vecera) [RHEL-37004] {CVE-2024-35855} - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (Ivan Vecera) [RHEL-37012] {CVE-2024-35853} - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work (Ivan Vecera) [RHEL-37016] {CVE-2024-35852} - mlxsw: spectrum_acl_tcam: Fix warning during rehash (Ivan Vecera) [RHEL-37480] {CVE-2024-36007} - can: peak_pci: peak_pci_remove(): fix UAF (Jose Ignacio Tornos Martinez) [RHEL-38419] {CVE-2021-47456} - usbnet: fix error return code in usbnet_probe() (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - usbnet: sanity check for maxpacket (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - net/mlx5e: fix a double-free in arfs_create_groups (Kamal Heib) [RHEL-36920] {CVE-2024-35835} - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds (Jose Ignacio Tornos Martinez) [RHEL-38220] {CVE-2023-52878} - net: cdc_eem: fix tx fixup skb leak (Jose Ignacio Tornos Martinez) [RHEL-38080] {CVE-2021-47236} - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Jose Ignacio Tornos Martinez) [RHEL-38113] {CVE-2023-52703} - usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() (Desnes Nunes) [RHEL-38248] {CVE-2023-52877} - usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (Desnes Nunes) [RHEL-38240] {CVE-2023-52781} - gro: fix ownership transfer (Xin Long) [RHEL-37226] {CVE-2024-35890} - tipc: fix kernel warning when sending SYN message (Xin Long) [RHEL-38109] {CVE-2023-52700} - erspan: make sure erspan_base_hdr is present in skb->head (Xin Long) [RHEL-37230] {CVE-2024-35888} - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() (Bryan Gurney) [RHEL-17366] - scsi: mpi3mr: Sanitise num_phys (Bryan Gurney) [RHEL-17366] - netfilter: nf_tables: use timestamp to check for set element timeout (Phil Sutter) [RHEL-38023] {CVE-2024-27397} - net/ipv6: SKB symmetric hash should incorporate transport ports (Sabrina Dubroca) [RHEL-32061] - crypto: s390/aes - Fix buffer overread in CTR mode (Herbert Xu) [RHEL-37089] {CVE-2023-52669} - net: Save and restore msg_namelen in sock_sendmsg (Jamie Bainbridge) [RHEL-35893] - net: prevent address rewrite in kernel_bind() (Jamie Bainbridge) [RHEL-35893] - net: prevent rewrite of msg_name in sock_sendmsg() (Jamie Bainbridge) [RHEL-35893] - net: replace calls to sock->ops->connect() with kernel_connect() (Jamie Bainbridge) [RHEL-35893] - net: Avoid address overwrite in kernel_connect (Jamie Bainbridge) [RHEL-35893] - wifi: iwlwifi: dbg-tlv: ensure NUL termination (Jose Ignacio Tornos Martinez) [RHEL-37026] {CVE-2024-35845} - wifi: mac80211: fix potential sta-link leak (Jose Ignacio Tornos Martinez) [RHEL-36916] {CVE-2024-35838} - wifi: nl80211: reject iftype change with mesh ID change (Jose Ignacio Tornos Martinez) [RHEL-36884] {CVE-2024-27410} - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (Jose Ignacio Tornos Martinez) [RHEL-36807] {CVE-2024-35789} - Bluetooth: Avoid potential use-after-free in hci_error_reset (David Marlin) [RHEL-31826] {CVE-2024-26801} - tls: disable async encrypt/decrypt (Sabrina Dubroca) [RHEL-26362 RHEL-26409 RHEL-26420] {CVE-2024-26585 CVE-2024-26583 CVE-2024-26584} - Squashfs: check the inode number is not the invalid value of zero (Phillip Lougher) [RHEL-35096] {CVE-2024-26982} - ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/msg.c: update and document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/sem.c: document and update memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: update/document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: remove duplicated code (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (Kamal Heib) [RHEL-30582] {CVE-2023-52626} - Revert "ACPI: bus: Rework system-level device notification handling" (Prarit Bhargava) [RHEL-21486] - hwrng: core - Fix page fault dead lock on mmap-ed hwrng (Prarit Bhargava) [RHEL-29485] {CVE-2023-52615} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - powerpc/pseries: pci - logic bug (Mamatha Inamdar) [RHEL-240146] - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228} - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899] {CVE-2026-90036} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680] {CVE-2026-72262} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641} - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781] {CVE-2026-74583} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916] {CVE-2026-68377} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271288] {CVE-2026-89631} - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280060] {CVE-2026-98320} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271853] {CVE-2026-93817} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191034] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191034] {CVE-2026-53196} - gfs2: a minor finish_xmote cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor run_queue fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: only apply DLM_LKF_VALBLK if sb_lvbptr is not NULL (Alexander Aring) [RHEL-129363] - gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Use wait_event_freezable_timeout() for freezable kthread (Andreas Gruenbacher) [RHEL-129363] - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-129363] - gfs2: low-memory forced flush fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: add missing withdraw locking (Andreas Gruenbacher) [RHEL-129363] - gfs2: Disable GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename "gfs_recovery" workqueue to "gfs2_recovery" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-129363] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-129363] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify do_promote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-129363] - gfs2: introduce new gfs2_glock_assert_withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify refcounting in do_xmote (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Make recovery error more readable (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark the remaining process-independent glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark flock glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of newlines in log messages (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-129363] - gfs2: Sanitize kthread stopping (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix logd wakeup on I/O error (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_quotad (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_logd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove duplicate check in do_xmote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove space before newline (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix LM_FLAG_TRY* logic in add_to_queue (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove DLM_LKF_ALTCW / DLM_LKF_ALTPR code (Andreas Gruenbacher) [RHEL-129363] - gfs2: Further sanitize lock_dlm.c (Andreas Gruenbacher) [RHEL-129363] - gfs2: sanitize the gdlm_ast -> finish_xmote interface (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify DLM_LKF_QUECVT use (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-129363] - gfs2: Lift withdraw check out of gfs2_ail1_empty (Andreas Gruenbacher) [RHEL-129363] - gfs2: don't withdraw if init_threads() got interrupted (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-129363] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix slab-use-after-free in gfs2_qd_dealloc (Andreas Gruenbacher) [RHEL-129363] {CVE-2023-52760} - gfs2: Fix asynchronous thread destruction (Andreas Gruenbacher) [RHEL-129363] - gfs2: Stop using gfs2_make_fs_ro for withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-129363] - gfs2: Turn gfs2_withdraw into a void function (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark withdraws as unlikely (Andreas Gruenbacher) [RHEL-129363] - gfs2: ignore rindex_update failure in dinode_dealloc (Andreas Gruenbacher) [RHEL-129363] - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270732] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256684] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256684] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256684] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271657] {CVE-2026-93288} - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254282] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-263292] {CVE-2026-89479} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254357] {CVE-2026-74588} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222954] {CVE-2026-52935} - powerpc/pseries: pci - logic bug (Mamatha Inamdar) [RHEL-240146] - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228} - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899] {CVE-2026-90036} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680] {CVE-2026-72262} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641} - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781] {CVE-2026-74583} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916] {CVE-2026-68377} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270905] {CVE-2026-89777} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263644] {CVE-2026-68202} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254200] {CVE-2026-80590} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233134] {CVE-2026-64572} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225459] {CVE-2026-64114} - xfs: bounds-check buffer log item's dirty bitmap (CKI Backport Bot) [RHEL-253365] {CVE-2026-80536} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234242] {CVE-2026-64266} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271288] {CVE-2026-89631} - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280060] {CVE-2026-98320} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271853] {CVE-2026-93817} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191034] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191034] {CVE-2026-53196} - gfs2: a minor finish_xmote cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor run_queue fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: only apply DLM_LKF_VALBLK if sb_lvbptr is not NULL (Alexander Aring) [RHEL-129363] - gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Use wait_event_freezable_timeout() for freezable kthread (Andreas Gruenbacher) [RHEL-129363] - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-129363] - gfs2: low-memory forced flush fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: add missing withdraw locking (Andreas Gruenbacher) [RHEL-129363] - gfs2: Disable GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename "gfs_recovery" workqueue to "gfs2_recovery" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-129363] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-129363] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify do_promote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-129363] - gfs2: introduce new gfs2_glock_assert_withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify refcounting in do_xmote (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Make recovery error more readable (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark the remaining process-independent glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark flock glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of newlines in log messages (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-129363] - gfs2: Sanitize kthread stopping (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix logd wakeup on I/O error (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_quotad (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_logd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove duplicate check in do_xmote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove space before newline (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix LM_FLAG_TRY* logic in add_to_queue (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove DLM_LKF_ALTCW / DLM_LKF_ALTPR code (Andreas Gruenbacher) [RHEL-129363] - gfs2: Further sanitize lock_dlm.c (Andreas Gruenbacher) [RHEL-129363] - gfs2: sanitize the gdlm_ast -> finish_xmote interface (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify DLM_LKF_QUECVT use (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-129363] - gfs2: Lift withdraw check out of gfs2_ail1_empty (Andreas Gruenbacher) [RHEL-129363] - gfs2: don't withdraw if init_threads() got interrupted (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-129363] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix slab-use-after-free in gfs2_qd_dealloc (Andreas Gruenbacher) [RHEL-129363] {CVE-2023-52760} - gfs2: Fix asynchronous thread destruction (Andreas Gruenbacher) [RHEL-129363] - gfs2: Stop using gfs2_make_fs_ro for withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-129363] - gfs2: Turn gfs2_withdraw into a void function (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark withdraws as unlikely (Andreas Gruenbacher) [RHEL-129363] - gfs2: ignore rindex_update failure in dinode_dealloc (Andreas Gruenbacher) [RHEL-129363] - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270732] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256684] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256684] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256684] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271657] {CVE-2026-93288} - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254282] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-263292] {CVE-2026-89479} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254357] {CVE-2026-74588} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222954] {CVE-2026-52935} - powerpc/pseries: pci - logic bug (Mamatha Inamdar) [RHEL-240146] - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228} - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899] {CVE-2026-90036} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680] {CVE-2026-72262} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641} - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781] {CVE-2026-74583} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916] {CVE-2026-68377} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - [rt] build kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 [RHEL-53529] - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071} - [rt] build kernel-rt-4.18.0-553.21.1.rt7.362.el8_10 [RHEL-53529] - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874] - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558} - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441} - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904} - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322} - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246} - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008} - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228} - [rt] build kernel-rt-4.18.0-553.20.1.rt7.361.el8_10 [RHEL-53529] - KVM: arm64: Disassociate vcpus from redistributor region on teardown (Shaoqin Huang) [RHEL-48417] {CVE-2024-40989} - devres: Fix memory leakage caused by driver API devm_free_percpu() (CKI Backport Bot) [RHEL-55597] {CVE-2024-43871} - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (Izabela Bakollari) [RHEL-26680] {CVE-2024-26600} - nvmet-fc: avoid deadlock on delete association path (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - nvmet-fc: release reference on target port (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - ACPI: LPIT: Avoid u32 multiplication overflow (Mark Langsdorf) [RHEL-37062] {CVE-2023-52683} - sched/deadline: Fix task_struct reference leak (Phil Auld) [RHEL-50904] {CVE-2024-41023} - nfsd: fix crash on LOCKT on reexported NFSv3 (Benjamin Coddington) [RHEL-31515] - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path (CKI Backport Bot) [RHEL-26570] {CVE-2024-26595} - mlxsw: spectrum_acl_tcam: Move devlink param to TCAM code (Ivan Vecera) [RHEL-26570] {CVE-2024-26595} - ACPI: extlog: fix NULL pointer dereference check (Mark Langsdorf) [RHEL-29110] {CVE-2023-52605} - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() (Mark Langsdorf) [RHEL-33198] {CVE-2024-26894} - mm: prevent derefencing NULL ptr in pfn_section_valid() (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - mm, kmsan: fix infinite recursion due to RCU critical section (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - cipso: make cipso_v4_skbuff_delattr() fully remove the CIPSO options (Ondrej Mosnacek) [RHEL-30904] - cipso: fix total option length computation (Ondrej Mosnacek) [RHEL-30904] - ext4: do not create EA inode under buffer lock (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: check the return value of ext4_xattr_inode_dec_ref() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (Carlos Maiolino) [RHEL-48507] {CVE-2024-40998} - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - [rt] build kernel-rt-4.18.0-553.19.1.rt7.360.el8_10 [RHEL-53529] - drm/i915/vma: Fix UAF on destroy against retire race (Mika Penttilä) [RHEL-35222] {CVE-2024-26939} - RHEL-48620 (Kenneth Yin) [RHEL-48620] - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (CKI Backport Bot) [RHEL-42721] {CVE-2024-26855} - net: usb: asix: do not force pause frames support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix "can't send until first packet is send" issue (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix modprobe "sysfs: cannot create duplicate filename" (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: add proper error handling of usb read errors (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix wrong return value in asix_check_host_enable() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix uninit-value in asix_mdio_read() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: fix boolconv.cocci warnings (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: do not call phy_disconnect() for ax88178 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: move embedded PHY detection as early as possible (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix uninit value bugs (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add missing stop (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: suspend PHY on driver probe (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: manage PHY PM from MAC (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: add error handling for asix_mdio_* functions (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add phylib support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: refactor asix_read_phy_addr() and handle errors on return (Ken Cox) [RHEL-28108] {CVE-2021-47101} - SUNRPC: always free ctxt when freeing deferred request (Jay Shin) [RHEL-40936] - SUNRPC: double free xprt_ctxt while still in use (Jay Shin) [RHEL-40936] - SUNRPC: Remove svc_rqst::rq_xprt_hlen (Jay Shin) [RHEL-40936] - SUNRPC: Remove dead code in svc_tcp_release_rqst() (Jay Shin) [RHEL-40936] - x86/bugs: Extend VMware Retbleed workaround to Nehalem & earlier CPUs (Waiman Long) [RHEL-48646] - wifi: iwlwifi: read txq->read_ptr under lock (Jose Ignacio Tornos Martinez) [RHEL-39797] {CVE-2024-36922} - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (John Meneghini) [RHEL-39908] {CVE-2024-36919} - nbd: always initialize struct msghdr completely (Ming Lei) [RHEL-29498] {CVE-2024-26638} - block: don't call rq_qos_ops->done_bio if the bio isn't tracked (Ming Lei) [RHEL-42151] {CVE-2021-47412} - nvmet: fix a possible leak when destroy a ctrl during qp establishment (Maurizio Lombardi) [RHEL-52013] {CVE-2024-42152} - ipv6: prevent NULL dereference in ip6_output() (Sabrina Dubroca) [RHEL-39912] {CVE-2024-36901} - ppp: reject claimed-as-LCP but actually malformed packets (Guillaume Nault) [RHEL-51052] {CVE-2024-41044} - leds: trigger: Unregister sysfs attributes before calling deactivate() (CKI Backport Bot) [RHEL-54834] {CVE-2024-43830} - crypto: bcm - Fix pointer arithmetic (cki-backport-bot) [RHEL-44108] {CVE-2024-38579} - scsi: qedf: Ensure the copied buf is NUL terminated (John Meneghini) [RHEL-44195] {CVE-2024-38559} - x86/bhi: Avoid warning in #DB handler due to BHI mitigation (Waiman Long) [RHEL-53657] {CVE-2024-42240} - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (CKI Backport Bot) [RHEL-47529] {CVE-2024-40901} - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (CKI Backport Bot) [RHEL-39843] {CVE-2024-36902} - net: usb: ax88179_178a: improve link status logs (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: improve reset check (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: fix link status when link is set to down/up (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: avoid writing the mac address before first reading (Jose Ignacio Tornos Martinez) [RHEL-45167] - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - media: cec: cec-api: add locking in cec_release() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid confusing "transmit timed out" message (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid recursive cec_claim_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: remove length check of Timer Status (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: count low-drive, error and arb-lost conditions (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add note about *_from_edid() function usage in drm (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_unconfigured() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_nb_transmit_canceled() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: don't set last_initiator if tx in progress (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: disable adapter in cec_devnode_unregister (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: not all messages were passed on when monitoring (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add support for Absolute Volume Control (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: log when claiming LA fails unexpectedly (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: drop activate_cnt, use state info instead (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: reconfigure if the PA changes during configuration (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: fix is_configuring state (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: stop trying LAs on CEC_TX_STATUS_TIMEOUT (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't unconfigure if already unconfigured (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add optional adap_configured callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add xfer_timeout_ms field (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: use call_op and check for !unregistered (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix interrupt en/disable handling (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: drop unused 'enabled' field from struct cec_pin (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix off-by-one SFT check (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: rename timer overrun variables (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: correctly pass on reply results (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: abort if the current transmit was canceled (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: call enable_adap on s_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: media/cec.h: document cec_adapter fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix a deadlock situation (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: safely unhook lists in cec_data (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: copy sequence field for the reply (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix trivial style warnings (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: add 'unregistered' checks (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't use flush_scheduled_work() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: Use fallthrough pseudo-keyword (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: remove unused waitq and phys_addrs fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: silence shift wrapping warning in __cec_s_log_addrs() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: move the core to a separate directory (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - net/iucv: Avoid explicit cpumask var allocation on stack (CKI Backport Bot) [RHEL-51631] {CVE-2024-42094} - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (Dick Kennedy) [RHEL-40400] - KVM: selftests: Make hyperv_clock require TSC based system clocksource (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Run clocksource dependent tests with hyperv_clocksource_tsc_page too (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Use generic sys_clocksource_is_tsc() in vmx_nested_tsc_scaling_test (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Generalize check_clocksource() from kvm_clock_test (Vitaly Kuznetsov) [RHEL-19027] - firmware: cs_dsp: Return error if block header overflows file (CKI Backport Bot) [RHEL-53646] {CVE-2024-42238} - firmware: cs_dsp: Validate payload length before processing block (CKI Backport Bot) [RHEL-53638] {CVE-2024-42237} - mm, slub: fix potential memoryleak in kmem_cache_open() (Waiman Long) [RHEL-38404] {CVE-2021-47466} - slub: don't panic for memcg kmem cache creation failure (Waiman Long) [RHEL-38404] {CVE-2021-47466} - wifi: ath11k: fix htt pktlog locking (Jose Ignacio Tornos Martinez) [RHEL-38317] {CVE-2023-52800} - wifi: ath11k: fix dfs radar event locking (Jose Ignacio Tornos Martinez) [RHEL-38165] {CVE-2023-52798} - lib/generic-radix-tree.c: Don't overflow in peek() (Waiman Long) [RHEL-37737] {CVE-2021-47432} - include/linux/generic-radix-tree.h: replace kernel.h with the necessary inclusions (Waiman Long) [RHEL-37737] {CVE-2021-47432} - EDAC/i10nm: Skip the absent memory controllers (Aristeu Rozanski) [RHEL-43236] - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (John Meneghini) [RHEL-38197] {CVE-2023-52809} - gfs2: Fix potential glock use-after-free on unmount (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: simplify gdlm_put_lock with out_free label (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: Remove ill-placed consistency check (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - nvme-fc: do not wait in vain when unloading module (Ewan D. Milne) [RHEL-33083] {CVE-2024-26846} - HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts (CKI Backport Bot) [RHEL-49698] {CVE-2022-48866} - scsi: qedf: Set qed_slowpath_params to zero before use (John Meneghini) [RHEL-9797] - scsi: qedf: Wait for stag work during unload (John Meneghini) [RHEL-9797] - scsi: qedf: Don't process stag work during unload and recovery (John Meneghini) [RHEL-9797] - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - mm: avoid overflows in dirty throttling logic (Audra Mitchell) [RHEL-51840] {CVE-2024-42131} - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - ACPI: fix NULL pointer dereference (Mark Langsdorf) [RHEL-37897] {CVE-2021-47289} - [rt] build kernel-rt-4.18.0-553.18.1.rt7.359.el8_10 [RHEL-53529] - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING (Ewan D. Milne) [RHEL-39805] {CVE-2024-36920} - tun: limit printing rate when illegal packet received by tun dev (Jon Maloy) [RHEL-35046] {CVE-2024-27013} - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu/mes: fix use-after-free issue (Michel Dänzer) [RHEL-44043] {CVE-2024-38581} - drm/amdgpu: Fix the null pointer when load rlc firmware (Michel Dänzer) [RHEL-30603] {CVE-2024-26649} - drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (Michel Dänzer) [RHEL-35160] {CVE-2024-27042} - net/sched: Fix UAF when resolving a clash (Xin Long) [RHEL-51014] {CVE-2024-41040} - tcp_metrics: validate source addr length (Guillaume Nault) [RHEL-52025] {CVE-2024-42154} - NFSv4/pnfs: Fix a use-after-free bug in open (Benjamin Coddington) [RHEL-35508] - NFSv4: Don't hold the layoutget locks across multiple RPC calls (Benjamin Coddington) [RHEL-35508] - scsi: qedf: Make qedf_execute_tmf() non-preemptible (John Meneghini) [RHEL-51799] {CVE-2024-42124} - Input: elantech - fix stack out of bound access in elantech_change_report_id() (CKI Backport Bot) [RHEL-41938] {CVE-2021-47097} - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (CKI Backport Bot) [RHEL-28982] {CVE-2023-52478} - drm/radeon: fix UBSAN warning in kv_dpm.c (CKI Backport Bot) [RHEL-48399] {CVE-2024-40988} - usb: core: Don't hold the device lock while sleeping in do_proc_control() (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - USB: core: Make do_proc_control() and do_proc_bulk() killable (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - scsi: qedi: Fix crash while reading debugfs attribute (CKI Backport Bot) [RHEL-48327] {CVE-2024-40978} - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CKI Backport Bot) [RHEL-48309] {CVE-2024-40977} - net: tcp: accept old ack during closing (Jamie Bainbridge) [RHEL-52433] - wifi: iwlwifi: mvm: don't read past the mfuart notifcation (CKI Backport Bot) [RHEL-48016] {CVE-2024-40941} - net/iucv: fix use after free in iucv_sock_close() (Mete Durlu) [RHEL-53988] - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (CKI Backport Bot) [RHEL-47908] {CVE-2024-40929} - Input: aiptek - properly check endpoint type (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - use descriptors of current altsetting (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - fix endpoint sanity check (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB (CKI Backport Bot) [RHEL-52373] {CVE-2024-42226} - wifi: mt76: replace skb_put with skb_put_zero (CKI Backport Bot) [RHEL-52366] {CVE-2024-42225} - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (CKI Backport Bot) [RHEL-47776] {CVE-2024-40912} - wifi: cfg80211: Lock wiphy in cfg80211_get_station (CKI Backport Bot) [RHEL-47758] {CVE-2024-40911} - VMCI: Use struct_size() in kmalloc() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() (Steve Best) [RHEL-37325] {CVE-2024-35944} - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values (Jose Ignacio Tornos Martinez) [RHEL-51761] {CVE-2024-42114} - usb: atm: cxacru: fix endpoint checking in cxacru_bind() (CKI Backport Bot) [RHEL-51442] {CVE-2024-41097} - nfs: handle error of rpc_proc_register() in init_nfs_fs() (Scott Mayhew) [RHEL-39904] {CVE-2024-36939} - drm/radeon: check bo_va->bo is non-NULL before using it (CKI Backport Bot) [RHEL-51184] {CVE-2024-41060} - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). (CKI Backport Bot) [RHEL-51027] {CVE-2024-41041} - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (CKI Backport Bot) [RHEL-50961] {CVE-2024-41035} - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). (CKI Backport Bot) [RHEL-44408] {CVE-2024-37356} - tcp: avoid too many retransmit packets (Florian Westphal) [RHEL-48627] {CVE-2024-41007} - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() (Florian Westphal) [RHEL-48627] - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Florian Westphal) [RHEL-48627] - tcp: refactor tcp_retransmit_timer() (Florian Westphal) [RHEL-48627] - tcp: exit if nothing to retransmit on RTO timeout (Florian Westphal) [RHEL-48627] - netfilter: nf_tables: Reject tables of unsupported family (Florian Westphal) [RHEL-21418] {CVE-2023-6040} - [rt] build kernel-rt-4.18.0-553.17.1.rt7.358.el8_10 [RHEL-53529] - kyber: fix out of bounds access when preempted (Ming Lei) [RHEL-27258] {CVE-2021-46984} - vfs: don't mod negative dentry count when on shrinker list (Brian Foster) [RHEL-35874] - fs/dcache: Re-use value stored to dentry->d_flags instead of re-reading (Brian Foster) [RHEL-35874] - fbmem: Do not delete the mode that is still in use (CKI Backport Bot) [RHEL-37796] {CVE-2021-47338} - netpoll: Fix race condition in netpoll_owner_active (CKI Backport Bot) [RHEL-49361] {CVE-2024-41005} - firmware: arm_scpi: Fix string overflow in SCPI genpd driver (Mark Salter) [RHEL-43702] {CVE-2021-47609} - ipv6: prevent possible NULL dereference in rt6_probe() (Guillaume Nault) [RHEL-48149] {CVE-2024-40960} - HID: i2c-hid-of: fix NULL-deref on failed power up (CKI Backport Bot) [RHEL-31598] {CVE-2024-26717} - cpufreq: amd-pstate: fix memory leak on CPU EPP exit (CKI Backport Bot) [RHEL-48489] {CVE-2024-40997} - x86/mm/pat: fix VM_PAT handling in COW mappings (Chris von Recklinghausen) [RHEL-37258] {CVE-2024-35877} - PCI/PM: Drain runtime-idle callbacks before driver removal (Myron Stowe) [RHEL-42937] {CVE-2024-35809} - PCI: Drop pci_device_remove() test of pci_dev->driver (Myron Stowe) [RHEL-42937] {CVE-2024-35809} - drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() (Mika Penttilä) [RHEL-26909] {CVE-2023-52470} - USB: core: Fix hang in usb_kill_urb by adding memory barriers (Desnes Nunes) [RHEL-43979] {CVE-2022-48760} - cifs: fix bad fids sent over wire (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB311_posix_mkdir (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB2_tcon (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB2_open (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB2_ioctl (Paulo Alcantara) [RHEL-52517] - selftests: forwarding: devlink_lib: Wait for udev events after reloading (Mark Langsdorf) [RHEL-47642] {CVE-2024-39501} - drivers: core: synchronize really_probe() and dev_uevent() (Mark Langsdorf) [RHEL-47642] {CVE-2024-39501} - udp: do not accept non-tunnel GSO skbs landing in a tunnel (Xin Long) [RHEL-42997] {CVE-2024-35884} - filelock: Remove locks reliably when fcntl/close race is detected (Bill O'Donnell) [RHEL-50170] {CVE-2024-41012} - Input: add bounds checking to input_set_capability() (Benjamin Tissoires) [RHEL-21413] {CVE-2022-48619} - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() (CKI Backport Bot) [RHEL-48130] {CVE-2024-40959} - blk-cgroup: fix list corruption from reorder of WRITE ->lqueued (Ming Lei) [RHEL-33695] - blk-cgroup: fix list corruption from resetting io stat (Ming Lei) [RHEL-33695] - net: do not leave a dangling sk pointer, when socket creation fails (CKI Backport Bot) [RHEL-48060] {CVE-2024-40954} - perf/x86/lbr: Filter vsyscall addresses (Michael Petlan) [RHEL-28991] {CVE-2023-52476} - vmci: prevent speculation leaks by sanitizing event in event_deliver() (CKI Backport Bot) [RHEL-47678] {CVE-2024-39499} - serial: core: fix transmit-buffer reset and memleak (Steve Best) [RHEL-38731] {CVE-2021-47527} - powerpc/pseries: Whitelist dtl slub object for copying to userspace (Mamatha Inamdar) [RHEL-51236] {CVE-2024-41065} - powerpc/eeh: avoid possible crash when edev->pdev changes (Mamatha Inamdar) [RHEL-51220] {CVE-2024-41064} - x86: stop playing stack games in profile_pc() (Steve Best) [RHEL-51643] {CVE-2024-42096} - mptcp: ensure snd_una is properly initialized on connect (Florian Westphal) [RHEL-47933 RHEL-47934] {CVE-2024-40931} - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet (CKI Backport Bot) [RHEL-47492] {CVE-2024-39506} - tun: add missing verification for short frame (Patrick Talbert) [RHEL-50194] {CVE-2024-41091} - tap: add missing verification for short frame (Patrick Talbert) [RHEL-50279] {CVE-2024-41090} - usb-storage: alauda: Check whether the media is initialized (Desnes Nunes) [RHEL-43708] {CVE-2024-38619} - usb-storage: alauda: Fix uninit-value in alauda_check_media() (Desnes Nunes) [RHEL-43708] {CVE-2024-38619} - hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37723] {CVE-2021-47384} - block: fix that util can be greater than 100% (Ming Lei) [RHEL-23074] - block: support to account io_ticks precisely (Ming Lei) [RHEL-23074] - watchdog: Fix possible use-after-free by calling del_timer_sync() (Steve Best) [RHEL-38795] {CVE-2021-47321} - hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37719] {CVE-2021-47385} - mlxsw: spectrum: Protect driver from buggy firmware (CKI Backport Bot) [RHEL-42245] {CVE-2021-47560} - mlxsw: Verify the accessed index doesn't exceed the array length (CKI Backport Bot) [RHEL-42245] {CVE-2021-47560} - dm: call the resume method on internal suspend (Benjamin Marzinski) [RHEL-41835] {CVE-2024-26880} - tty: Fix out-of-bound vmalloc access in imageblit (Steve Best) [RHEL-37727] {CVE-2021-47383} - hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37715] {CVE-2021-47386} - hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs (Steve Best) [RHEL-37710] {CVE-2021-47393} - nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells (Steve Best) [RHEL-38436] {CVE-2021-47497} - driver core: auxiliary bus: Fix memory leak when driver_register() fail (Steve Best) [RHEL-37901] {CVE-2021-47287} - phylib: fix potential use-after-free (cki-backport-bot) [RHEL-43764] {CVE-2022-48754} - ptp: Fix possible memory leak in ptp_clock_register() (Hangbin Liu) [RHEL-38424] {CVE-2021-47455} - NFSv4: Fix memory leak in nfs4_set_security_label (CKI Backport Bot) [RHEL-51315] {CVE-2024-41076} - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER (CKI Backport Bot) [RHEL-51618] {CVE-2024-42090} - ftruncate: pass a signed offset (CKI Backport Bot) [RHEL-51598] {CVE-2024-42084} - af_unix: Fix garbage collector racing against connect() (Felix Maurer) [RHEL-34225] {CVE-2024-26923} - virtio-net: Add validation for used length (Laurent Vivier) [RHEL-42080] {CVE-2021-47352} - net: fix possible store tearing in neigh_periodic_work() (Antoine Tenart) [RHEL-42359] {CVE-2023-52522} - tunnels: fix out of bounds access when building IPv6 PMTU error (Antoine Tenart) [RHEL-41823] {CVE-2024-26665} - vt_ioctl: fix array_index_nospec in vt_setactivate (John W. Linville) [RHEL-49141] {CVE-2022-48804} - Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() (CKI Backport Bot) [RHEL-38302] {CVE-2023-52840} - netns: Make get_net_ns() handle zero refcount net (Antoine Tenart) [RHEL-48105] {CVE-2024-40958} - tracing: Ensure visibility when inserting an element into tracing_map (Michael Petlan) [RHEL-30457] {CVE-2024-26645} - KVM: s390: fix LPSWEY handling (CKI Backport Bot) [RHEL-50072] - firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files (CKI Backport Bot) [RHEL-51144] {CVE-2024-41056} - SUNRPC: Fix a race to wake a sync task (Benjamin Coddington) [RHEL-11843] - firmware: cs_dsp: Fix overflow checking of wmfw header (CKI Backport Bot) [RHEL-50999] {CVE-2024-41039} - firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers (CKI Backport Bot) [RHEL-50987] {CVE-2024-41038} - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (Xin Long) [RHEL-48471] {CVE-2024-40995} - net: fix out-of-bounds access in ops_init (Xin Long) [RHEL-43185] {CVE-2024-36883} - x86/mce/therm_throt: Undo thermal polling properly on CPU offline (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Do not access uninitialized therm_work (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Mark throttle_active_work() as __maybe_unused (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Mask out read-only and reserved MSR bits (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Optimize notifications of thermal throttle (Steve Best) [RHEL-45310] - jiffies: add utility function to calculate delta in ms (Steve Best) [RHEL-45310] - x86/mce: Lower throttling MCE messages' priority to warning (Steve Best) [RHEL-45310] - dmaengine: idxd: Fix oops during rmmod on single-CPU platforms (Eder Zulian) [RHEL-37361] {CVE-2024-35989} - xfs: don't walk off the end of a directory data block (CKI Backport Bot) [RHEL-50879] {CVE-2024-41013} - xfs: add bounds checking to xlog_recover_process_data (CKI Backport Bot) [RHEL-50856] {CVE-2024-41014} - dm-crypt: limit the size of encryption requests (Benjamin Marzinski) [RHEL-29330] - netfilter: flowtable: remove nf_ct_l4proto_find() call (Florian Westphal) [RHEL-49589] - [rt] build kernel-rt-4.18.0-553.16.1.rt7.357.el8_10 [RHEL-44553] - x86/bhi: Fix incorrect CLEAR_BRANCH_HISTORY position in entry_INT80_compat (Waiman Long) [RHEL-50648] - [rt] build kernel-rt-4.18.0-553.15.1.rt7.356.el8_10 [RHEL-44553] - Revert "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-44613] - ionic: fix use after netif_napi_del() (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - ionic: clean interrupt before enabling queue to avoid credit race (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change (CKI Backport Bot) [RHEL-49321] {CVE-2021-47624} - xhci: Handle TD clearing for multiple streams case (CKI Backport Bot) [RHEL-47882] {CVE-2024-40927} - net: openvswitch: Fix Use-After-Free in ovs_ct_exit (cki-backport-bot) [RHEL-36362] {CVE-2024-27395} - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: fix vlan use-after-free (cki-backport-bot) [RHEL-43721] {CVE-2024-36979} - irqchip/gic-v3-its: Prevent double free on error (Charles Mirabile) [RHEL-37022] {CVE-2024-35847} - irqchip/gic-v3-its: Fix potential VPE leak on error (Charles Mirabile) [RHEL-37744] {CVE-2021-47373} - i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() (Charles Mirabile) [RHEL-34735] {CVE-2022-48632} - iommu/dma: fix zeroing of bounce buffer padding used by untrusted devices (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: remove alloc_size argument to swiotlb_tbl_map_single() (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: fix swiotlb_bounce() to do partial sync's correctly (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Reinstate page-alignment for mappings >= PAGE_SIZE (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix alignment checks when both allocation and DMA masks are present (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix double-allocation of slots due to broken alignment handling (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (cki-backport-bot) [RHEL-44441] {CVE-2024-31076} - [rt] build kernel-rt-4.18.0-553.14.1.rt7.355.el8_10 [RHEL-44553] - s390/qeth: Fix kernel panic after setting hsuid (Mete Durlu) [RHEL-49754] - perf/core: Protect event sibling list locking against interrupt inversion (Daniel Vacek) [RHEL-31798] - vt: fix unicode buffer corruption when deleting characters (Steve Best) [RHEL-36936] {CVE-2024-35823} - cifs: translate network errors on send to -ECONNABORTED (Paulo Alcantara) [RHEL-36754] - xfs: don't block in busy flushing when freeing extents (Brian Foster) [RHEL-7984] - xfs: allow extent free intents to be retried (Brian Foster) [RHEL-7984] - xfs: pass alloc flags through to xfs_extent_busy_flush() (Brian Foster) [RHEL-7984] - xfs: use deferred frees for btree block freeing (Brian Foster) [RHEL-7984] - xfs: fix bounds check in xfs_defer_agfl_block() (Brian Foster) [RHEL-7984] - xfs: validate block number being freed before adding to xefi (Brian Foster) [RHEL-7984] - xfs: rename xfs_bmap_add_free to xfs_free_extent_later (Brian Foster) [RHEL-7984] - usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (Desnes Nunes) [RHEL-36803] {CVE-2024-35790} - stm class: Fix a double free in stm_register_device() (Steve Best) [RHEL-44514] {CVE-2024-38627} - s390/qeth: Fix potential loss of L3-IP@ in case of network issues (Mete Durlu) [RHEL-49755] - tls: fix missing memory barrier in tls_init (cki-backport-bot) [RHEL-44471] {CVE-2024-36489} - xfs: fix log recovery buffer allocation for the legacy h_size fixup (Bill O'Donnell) [RHEL-46473] {CVE-2024-39472} - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: use __for_each_thread() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - exit: Use the correct exit_code in /proc/<pid>/stat (Brian Foster) [RHEL-31562] {CVE-2024-26686} - scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool (Ewan D. Milne) [RHEL-38283] {CVE-2023-52811} - scsi: qla2xxx: Fix double free of fcport (Ewan D. Milne) [RHEL-39549] {CVE-2024-26929} - scsi: qla2xxx: Fix double free of the ha->vp_map pointer (Ewan D. Milne) [RHEL-39549] {CVE-2024-26930} - scsi: qla2xxx: Fix command flush on cable pull (Ewan D. Milne) [RHEL-39549] {CVE-2024-26931} - [rt] build kernel-rt-4.18.0-553.13.1.rt7.354.el8_10 [RHEL-44553] - redhat: remove handling of deleted rhdocs/ directory from genspec.sh (Denys Vlasenko) - x86/bugs: Fix BHI retpoline check (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI handling of RRSBA (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr' (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI documentation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix return type of spectre_bhi_state() (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Make CONFIG_SPECTRE_BHI_ON the default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Mitigate KVM by default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add BHI mitigation knob (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Enumerate Branch History Injection (BHI) bug (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Define SPEC_CTRL_BHI_DIS_S (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add support for clearing branch history at syscall entry (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file (Waiman Long) [RHEL-28202] - perf/x86/amd/lbr: Use freeze based on availability (Waiman Long) [RHEL-28202] - Documentation/kernel-parameters: Add spec_rstack_overflow to mitigations=off (Waiman Long) [RHEL-28202] - KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace (Waiman Long) [RHEL-28202] - x86/bugs: Reset speculation control settings on init (Waiman Long) [RHEL-28202] - KVM: x86: Update KVM-only leaf handling to allow for 100% KVM-only leafs (Waiman Long) [RHEL-28202] - KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest (Waiman Long) [RHEL-28202] - mptcp: ensure snd_nxt is properly initialized on connect (Davide Caratti) [RHEL-39865] {CVE-2024-36889} - powerpc/pseries: Enforce hcall result buffer validity and size (Mamatha Inamdar) [RHEL-48291] {CVE-2024-40974} - wifi: mac80211: fix potential key use-after-free (Jose Ignacio Tornos Martinez) [RHEL-28007] {CVE-2023-52530} - cppc_cpufreq: Fix possible null pointer dereference (Mark Langsdorf) [RHEL-44137] {CVE-2024-38573} - net/sched: act_mirred: use the backlog for mirred ingress (Davide Caratti) [RHEL-31718] {CVE-2024-26740} - vfio/pci: Lock external INTx masking ops (Alex Williamson) [RHEL-31922] {CVE-2024-26810} - net: sched: sch_multiq: fix possible OOB write in multiq_tune() (Davide Caratti) [RHEL-43464] {CVE-2024-36978} - tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized (Guillaume Nault) [RHEL-37850] {CVE-2021-47304} - pstore/ram: Fix crash when setting number of cpus to an odd number (Lenny Szubowicz) [RHEL-29471] {CVE-2023-52619} - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node (Jocelyn Falempe) [RHEL-37101] {CVE-2023-52662} - drm/vmwgfx: Fix the lifetime of the bo cursor memory (Jocelyn Falempe) [RHEL-36962] {CVE-2024-35810} - drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed (Jocelyn Falempe) [RHEL-34987] {CVE-2024-26940} - drm/vmwgfx: Unmap the surface before resetting it on a plane state (Jocelyn Falempe) [RHEL-35217] {CVE-2023-52648} - drm/vmwgfx: Fix invalid reads in fence signaled events (Jocelyn Falempe) [RHEL-40010] {CVE-2024-36960} - block: Fix wrong offset in bio_truncate() (Ming Lei) [RHEL-43782] {CVE-2022-48747} - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CKI Backport Bot) [RHEL-46913] {CVE-2024-39487} - net: fix __dst_negative_advice() race (Xin Long) [RHEL-41183] {CVE-2024-36971} - igc: avoid returning frame twice in XDP_REDIRECT (Corinna Vinschen) [RHEL-33264] {CVE-2024-26853} - mac802154: fix llsec key resources release in mac802154_llsec_key_del (Steve Best) [RHEL-34967] {CVE-2024-26961} - cpufreq: exit() callback is optional (Mark Langsdorf) [RHEL-43840] {CVE-2024-38615} - cifs: prevent infinite recursion in CIFSGetDFSRefer() (Paulo Alcantara) [RHEL-34672] - cifs: lock chan_lock outside match_session (Paulo Alcantara) [RHEL-34672] - smb3: workaround negprot bug in some Samba servers (Paulo Alcantara) [RHEL-34672] - smb3: use netname when available on secondary channels (Paulo Alcantara) [RHEL-34672] - smb3: fix empty netname context on secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: populate empty hostnames for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: always iterate smb sessions using primary channel (Paulo Alcantara) [RHEL-34672] - cifs: Fix connections leak when tlink setup failed (Paulo Alcantara) [RHEL-34672] - cifs: Fix memory leak when build ntlmssp negotiate blob failed (Paulo Alcantara) [RHEL-34672] - cifs: always initialize struct msghdr smb_msg completely (Paulo Alcantara) [RHEL-34672] - cifs: don't send down the destination address to sendmsg for a SOCK_STREAM (Paulo Alcantara) [RHEL-34672] - cifs: revalidate mapping when doing direct writes (Paulo Alcantara) [RHEL-34672] - cifs: skip extra NULL byte in filenames (Paulo Alcantara) [RHEL-34672] - cifs: list_for_each() -> list_for_each_entry() (Paulo Alcantara) [RHEL-34672] - smb2: small refactor in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - cifs: Fix crash on unload of cifs_arc4.ko (Paulo Alcantara) [RHEL-34672] - cifs: remove check of list iterator against head past the loop body (Paulo Alcantara) [RHEL-34672] - cifs: fix reconnect on smb3 mount types (Paulo Alcantara) [RHEL-34672] - cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (Paulo Alcantara) [RHEL-34672] - cifs: skip trailing separators of prefix paths (Paulo Alcantara) [RHEL-34672] - cifs: fix ntlmssp on old servers (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL ptr dereference in refresh_mounts() (Paulo Alcantara) [RHEL-34672] - cifs: do not skip link targets when an I/O fails (Paulo Alcantara) [RHEL-34672] - cifs: fix confusing unneeded warning message on smb2.1 and earlier (Paulo Alcantara) [RHEL-34672] - smb3: fix snapshot mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix workstation_name for multiuser mounts (Paulo Alcantara) [RHEL-34672] - cifs: alloc_path_with_tree_prefix: do not append sep. if the path is empty (Paulo Alcantara) [RHEL-34672] - cifs: free ntlmsspblob allocated in negotiate (Paulo Alcantara) [RHEL-34672] - cifs: avoid use of dstaddr as key for fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: add server conn_id to fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: fix missed refcounting of ipc tcon (Paulo Alcantara) [RHEL-34672] - smb2: clarify rc initialization in smb2_reconnect (Paulo Alcantara) [RHEL-34672] - cifs: populate server_hostname for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should be set on new server (Paulo Alcantara) [RHEL-34672] - cifs: introduce cifs_ses_mark_for_reconnect() helper (Paulo Alcantara) [RHEL-34672] - cifs: protect srv_count with cifs_tcp_ses_lock (Paulo Alcantara) [RHEL-34672] - cifs: move debug print out of spinlock (Paulo Alcantara) [RHEL-34672] - cifs: do not duplicate fscache cookie for secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: connect individual channel servers to primary channel server (Paulo Alcantara) [RHEL-34672] - cifs: protect session channel fields with chan_lock (Paulo Alcantara) [RHEL-34672] - cifs: do not negotiate session if session already exists (Paulo Alcantara) [RHEL-34672] - smb3: do not setup the fscache_super_cookie until fsinfo initialized (Paulo Alcantara) [RHEL-34672] - cifs: fix potential use-after-free bugs (Paulo Alcantara) [RHEL-34672] - cifs: release lock earlier in dequeue_mid error case (Paulo Alcantara) [RHEL-34672] - smb3: remove trivial dfs compile warning (Paulo Alcantara) [RHEL-34672] - cifs: support nested dfs links over reconnect (Paulo Alcantara) [RHEL-34672] - cifs: for compound requests, use open handle if possible (Paulo Alcantara) [RHEL-34672] - cifs: split out dfs code from cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant (Paulo Alcantara) [RHEL-34672] - cifs: introduce new helper for cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: fix print of hdr_flags in dfscache_proc_show() (Paulo Alcantara) [RHEL-34672] - cifs: send workstation name during ntlmssp session setup (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should not share socket with future sessions (Paulo Alcantara) [RHEL-34672] - smb3: add dynamic trace points for socket connection (Paulo Alcantara) [RHEL-34672] - cifs: Move SMB2_Create definitions to the shared area (Paulo Alcantara) [RHEL-34672] - cifs: Move more definitions into the shared area (Paulo Alcantara) [RHEL-34672] - cifs: move NEGOTIATE_PROTOCOL definitions out into the common area (Paulo Alcantara) [RHEL-34672] - cifs: Create a new shared file holding smb2 pdu definitions (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect check for null pointer in header_assemble (Paulo Alcantara) [RHEL-34672] - smb3: correct server pointer dereferencing check to be more consistent (Paulo Alcantara) [RHEL-34672] - cifs: Deal with some warnings from W=1 (Paulo Alcantara) [RHEL-34672] - cifs: fix a sign extension bug (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect kernel doc comments (Paulo Alcantara) [RHEL-34672] - cifs: remove pathname for file from SPDX header (Paulo Alcantara) [RHEL-34672] - cifs: move SMB FSCTL definitions to common code (Paulo Alcantara) [RHEL-34672] - cifs: rename cifs_common to smbfs_common (Paulo Alcantara) [RHEL-34672] - cifs: update FSCTL definitions (Paulo Alcantara) [RHEL-34672] - cifs: cifs_md4 convert to SPDX identifier (Paulo Alcantara) [RHEL-34672] - cifs: create a MD4 module and switch cifs.ko to use it (Paulo Alcantara) [RHEL-34672] - cifs: fork arc4 and create a separate module for it for cifs and other users (Paulo Alcantara) [RHEL-34672] - smb3: fix posix extensions mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix wrong release in sess_alloc_buffer() failed path (Paulo Alcantara) [RHEL-34672] - CIFS: Fix a potencially linear read overflow (Paulo Alcantara) [RHEL-34672] - cifs: use the correct max-length for dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: create sd context must be a multiple of 8 (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp sessions of dfs connections (Paulo Alcantara) [RHEL-34672] - cifs: added WARN_ON for all the count decrements (Paulo Alcantara) [RHEL-34672] - cifs: fix missing null session check in mount (Paulo Alcantara) [RHEL-34672] - cifs: handle reconnect of tcon when there is no cached dfs referral (Paulo Alcantara) [RHEL-34672] - cifs: fix the out of range assignment to bit fields in parse_server_interfaces (Paulo Alcantara) [RHEL-34672] - smb3: fix typo in header file (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: Add support for negotiating signing algorithm (Paulo Alcantara) [RHEL-34672] - cifs: prevent NULL deref in cifs_compose_mount_options() (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL dereference in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - smbdirect: missing rc checks while waiting for rdma events (Paulo Alcantara) [RHEL-34672] - cifs: Avoid field over-reading memcpy() (Paulo Alcantara) [RHEL-34672] - smb311: remove dead code for non compounded posix query info (Paulo Alcantara) [RHEL-34672] - cifs: fix SMB1 error path in cifs_get_file_info_unix (Paulo Alcantara) [RHEL-34672] - smb3: fix uninitialized value for port in witness protocol move (Paulo Alcantara) [RHEL-34672] - cifs: fix unneeded null check (Paulo Alcantara) [RHEL-34672] - cifs: use SPDX-Licence-Identifier (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in cifs_debug.c (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in smb2misc.c (Paulo Alcantara) [RHEL-34672] - cifs: missed ref-counting smb session in find (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp servers with dfs mounts (Paulo Alcantara) [RHEL-34672] - cifs: set a minimum of 2 minutes for refreshing dfs cache (Paulo Alcantara) [RHEL-34672] - cifs: Remove unused inline function is_sysvol_or_netlogon() (Paulo Alcantara) [RHEL-34672] - cifs: remove duplicated prototype (Paulo Alcantara) [RHEL-34672] - cifs: fix ipv6 formating in cifs_ses_add_channel (Paulo Alcantara) [RHEL-34672] - cifs: fix string declarations and assignments in tracepoints (Paulo Alcantara) [RHEL-34672] - cifs: fix memory leak in smb2_copychunk_range (Paulo Alcantara) [RHEL-34672] - SMB3: incorrect file id in requests compounded with open (Paulo Alcantara) [RHEL-34672] - smb3: if max_channels set to more than one channel request multichannel (Paulo Alcantara) [RHEL-34672] - smb3: do not attempt multichannel to server which does not support it (Paulo Alcantara) [RHEL-34672] - smb3: when mounting with multichannel include it in requested capabilities (Paulo Alcantara) [RHEL-34672] - cifs: simplify SWN code with dummy funcs instead of ifdefs (Paulo Alcantara) [RHEL-34672] - cifs: log mount errors using cifs_errorf() (Paulo Alcantara) [RHEL-34672] - cifs: switch build_path_from_dentry() to using dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: fix out-of-bound memory access when calling smb3_notify() at mount point (Paulo Alcantara) [RHEL-34672] - cifs: allocate buffer in the caller of build_path_from_dentry() (Paulo Alcantara) [RHEL-34672] - cifs: make build_path_from_dentry() return const char * (Paulo Alcantara) [RHEL-34672] - cifs: remove old dead code (Paulo Alcantara) [RHEL-34672] - fs: cifs: Remove repeated struct declaration (Paulo Alcantara) [RHEL-34672] - cifs: have cifs_fattr_to_inode() refuse to change type on live inode (Paulo Alcantara) [RHEL-34672] - cifs: have ->mkdir() handle race with another client sanely (Paulo Alcantara) [RHEL-34672] - do_cifs_create(): don't set ->i_mode of something we had not created (Paulo Alcantara) [RHEL-34672] - cifs: Silently ignore unknown oplock break handle (Paulo Alcantara) [RHEL-34672] - cifs: change noisy error message to FYI (Paulo Alcantara) [RHEL-34672] - cifs: print MIDs in decimal notation (Paulo Alcantara) [RHEL-34672] - cifs: minor simplification to smb2_is_network_name_deleted (Paulo Alcantara) [RHEL-34672] - TCON Reconnect during STATUS_NETWORK_NAME_DELETED (Paulo Alcantara) [RHEL-34672] - cifs: clarify hostname vs ip address in /proc/fs/cifs/DebugData (Paulo Alcantara) [RHEL-34672] - cifs: change confusing field serverName (to ip_addr) (Paulo Alcantara) [RHEL-34672] - cifs: Reformat DebugData and index connections by conn_id. (Paulo Alcantara) [RHEL-34672] - cifs: Identify a connection by a conn_id. (Paulo Alcantara) [RHEL-34672] - smb3: negotiate current dialect (SMB3.1.1) when version 3 or greater requested (Paulo Alcantara) [RHEL-34672] - smb3: Fix out-of-bounds bug in SMB2_negotiate() (Paulo Alcantara) [RHEL-34672] - fs/cifs: Simplify bool comparison. (Paulo Alcantara) [RHEL-34672] - fs/cifs: Assign boolean values to a bool variable (Paulo Alcantara) [RHEL-34672] - cifs: Avoid error pointer dereference (Paulo Alcantara) [RHEL-34672] - cifs: Re-indent cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Unlock on errors in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Delete a stray unlock in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Tracepoints and logs for tracing credit changes. (Paulo Alcantara) [RHEL-34672] - cifs: Fix some error pointers handling detected by static checker (Paulo Alcantara) [RHEL-34672] - smb3: remind users that witness protocol is experimental (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: do not log warning message if server doesn't populate salt (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: update comments clarifying SPNEGO info in negprot response (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot rsp (Paulo Alcantara) [RHEL-34672] - SMB3: avoid confusing warning message on mount to Azure (Paulo Alcantara) [RHEL-34672] - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (Nigel Croxon) [RHEL-46662] {CVE-2024-39476} - net: fix information leakage in /proc/net/ptype (Hangbin Liu) [RHEL-44000] {CVE-2022-48757} - usb: typec: ucsi: Limit read size on v1.2 (Desnes Nunes) [RHEL-37286] {CVE-2024-35924} - minmax: relax check to allow comparison between unsigned arguments and signed constants (Desnes Nunes) [RHEL-37286] - minmax: allow comparisons of 'int' against 'unsigned char/short' (Desnes Nunes) [RHEL-37286] - minmax: allow min()/max()/clamp() if the arguments have the same signedness. (Desnes Nunes) [RHEL-37286] - minmax: add umin(a, b) and umax(a, b) (Desnes Nunes) [RHEL-37286] - minmax: fix header inclusions (Desnes Nunes) [RHEL-37286] - minmax: clamp more efficiently by avoiding extra comparison (Desnes Nunes) [RHEL-37286] - minmax: sanity check constant bounds when clamping (Desnes Nunes) [RHEL-37286] - tracing: Define the is_signed_type() macro once (Desnes Nunes) [RHEL-37286] - linux/bits.h: fix compilation error with GENMASK (Desnes Nunes) [RHEL-37286] - x86/apic: Mask IOAPIC entries when disabling the local APIC (Lenny Szubowicz) [RHEL-18077] - userfaultfd: fix a race between writeprotect and exit_mmap() (Rafael Aquini) [RHEL-38410] {CVE-2021-47461} - mm: khugepaged: skip huge page collapse for special files (Waiman Long) [RHEL-38446] {CVE-2021-47491} - cachefiles: fix memory leak in cachefiles_add_cache() (Andrey Albershteyn) [RHEL-33109] {CVE-2024-26840} - drm/amd/display: Implement bounds check for stream encoder creation in DCN301 (Michel Dänzer) [RHEL-31429] {CVE-2024-26660} - net/mlx5: Discard command completions in internal error (Kamal Heib) [RHEL-44231] {CVE-2024-38555} - drm: Don't unref the same fb many times by mistake due to deadlock handling (CKI Backport Bot) [RHEL-29011] {CVE-2023-52486} - md: fix resync softlockup when bitmap size is less than array size (Nigel Croxon) [RHEL-43942] {CVE-2024-38598} - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation (Davide Caratti) [RHEL-39712] {CVE-2024-36017} - netfilter: nf_tables: discard table flag update with pending basechain deletion (Phil Sutter) [RHEL-37205] {CVE-2024-35897} - netfilter: nf_tables: reject table flag and netdev basechain updates (Phil Sutter) [RHEL-37205] - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (Ewan D. Milne) [RHEL-40172] {CVE-2024-36924} - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (Ewan D. Milne) [RHEL-40172] {CVE-2024-36952} - netfilter: nf_tables: fix memleak in map from abort path (Phil Sutter) [RHEL-35052] {CVE-2024-27011} - netfilter: nf_tables: reject new basechain after table flag update (Phil Sutter) [RHEL-37193] {CVE-2024-35900} - netfilter: nf_tables: flush pending destroy work before exit_net release (Phil Sutter) [RHEL-37197] {CVE-2024-35899} - netfilter: complete validation of user input (Phil Sutter) [RHEL-37210] - netfilter: validate user input for expected length (Phil Sutter) [RHEL-37210] {CVE-2024-35896} - netfilter: tproxy: bail out if IP has been disabled on the device (Phil Sutter) [RHEL-44363] {CVE-2024-36270} - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (Phil Sutter) [RHEL-44532] {CVE-2024-36286} - netfilter: nf_tables: do not compare internal table flags on updates (Phil Sutter) [RHEL-35114] {CVE-2024-27065} - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (Phil Sutter) [RHEL-35028] {CVE-2024-27019} - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (Phil Sutter) [RHEL-35024] {CVE-2024-27020} - netfilter: nf_tables: __nft_expr_type_get() selects specific family type (Phil Sutter) [RHEL-35024] - netfilter: conntrack: serialize hash resizes and cleanups (Phil Sutter) [RHEL-37703] {CVE-2021-47408} - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (Phil Sutter) [RHEL-34217] {CVE-2024-26925} - netfilter: nf_tables: release batch on table validation from abort path (Phil Sutter) [RHEL-34217] - ipvlan: add ipvlan_route_v6_outbound() helper (Davide Caratti) [RHEL-38319] {CVE-2023-52796} - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.23.1.rt7.364.el8_10 [RHEL-59541] - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002] - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924} - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042} - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070} - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898} - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301} - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976} - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540} - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284} - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857} - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924} - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983} - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854} - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936} - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093} - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961} - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880} - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244} - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984} - [rt] build kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 [RHEL-53529] - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071} - [rt] build kernel-rt-4.18.0-553.21.1.rt7.362.el8_10 [RHEL-53529] - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874] - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558} - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441} - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904} - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322} - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246} - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008} - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228} - [rt] build kernel-rt-4.18.0-553.20.1.rt7.361.el8_10 [RHEL-53529] - KVM: arm64: Disassociate vcpus from redistributor region on teardown (Shaoqin Huang) [RHEL-48417] {CVE-2024-40989} - devres: Fix memory leakage caused by driver API devm_free_percpu() (CKI Backport Bot) [RHEL-55597] {CVE-2024-43871} - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (Izabela Bakollari) [RHEL-26680] {CVE-2024-26600} - nvmet-fc: avoid deadlock on delete association path (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - nvmet-fc: release reference on target port (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - ACPI: LPIT: Avoid u32 multiplication overflow (Mark Langsdorf) [RHEL-37062] {CVE-2023-52683} - sched/deadline: Fix task_struct reference leak (Phil Auld) [RHEL-50904] {CVE-2024-41023} - nfsd: fix crash on LOCKT on reexported NFSv3 (Benjamin Coddington) [RHEL-31515] - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path (CKI Backport Bot) [RHEL-26570] {CVE-2024-26595} - mlxsw: spectrum_acl_tcam: Move devlink param to TCAM code (Ivan Vecera) [RHEL-26570] {CVE-2024-26595} - ACPI: extlog: fix NULL pointer dereference check (Mark Langsdorf) [RHEL-29110] {CVE-2023-52605} - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() (Mark Langsdorf) [RHEL-33198] {CVE-2024-26894} - mm: prevent derefencing NULL ptr in pfn_section_valid() (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - mm, kmsan: fix infinite recursion due to RCU critical section (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - cipso: make cipso_v4_skbuff_delattr() fully remove the CIPSO options (Ondrej Mosnacek) [RHEL-30904] - cipso: fix total option length computation (Ondrej Mosnacek) [RHEL-30904] - ext4: do not create EA inode under buffer lock (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: check the return value of ext4_xattr_inode_dec_ref() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (Carlos Maiolino) [RHEL-48507] {CVE-2024-40998} - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - [rt] build kernel-rt-4.18.0-553.19.1.rt7.360.el8_10 [RHEL-53529] - drm/i915/vma: Fix UAF on destroy against retire race (Mika Penttilä) [RHEL-35222] {CVE-2024-26939} - RHEL-48620 (Kenneth Yin) [RHEL-48620] - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (CKI Backport Bot) [RHEL-42721] {CVE-2024-26855} - net: usb: asix: do not force pause frames support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix "can't send until first packet is send" issue (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix modprobe "sysfs: cannot create duplicate filename" (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: add proper error handling of usb read errors (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix wrong return value in asix_check_host_enable() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix uninit-value in asix_mdio_read() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: fix boolconv.cocci warnings (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: do not call phy_disconnect() for ax88178 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: move embedded PHY detection as early as possible (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix uninit value bugs (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add missing stop (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: suspend PHY on driver probe (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: manage PHY PM from MAC (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: add error handling for asix_mdio_* functions (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add phylib support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: refactor asix_read_phy_addr() and handle errors on return (Ken Cox) [RHEL-28108] {CVE-2021-47101} - SUNRPC: always free ctxt when freeing deferred request (Jay Shin) [RHEL-40936] - SUNRPC: double free xprt_ctxt while still in use (Jay Shin) [RHEL-40936] - SUNRPC: Remove svc_rqst::rq_xprt_hlen (Jay Shin) [RHEL-40936] - SUNRPC: Remove dead code in svc_tcp_release_rqst() (Jay Shin) [RHEL-40936] - x86/bugs: Extend VMware Retbleed workaround to Nehalem & earlier CPUs (Waiman Long) [RHEL-48646] - wifi: iwlwifi: read txq->read_ptr under lock (Jose Ignacio Tornos Martinez) [RHEL-39797] {CVE-2024-36922} - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (John Meneghini) [RHEL-39908] {CVE-2024-36919} - nbd: always initialize struct msghdr completely (Ming Lei) [RHEL-29498] {CVE-2024-26638} - block: don't call rq_qos_ops->done_bio if the bio isn't tracked (Ming Lei) [RHEL-42151] {CVE-2021-47412} - nvmet: fix a possible leak when destroy a ctrl during qp establishment (Maurizio Lombardi) [RHEL-52013] {CVE-2024-42152} - ipv6: prevent NULL dereference in ip6_output() (Sabrina Dubroca) [RHEL-39912] {CVE-2024-36901} - ppp: reject claimed-as-LCP but actually malformed packets (Guillaume Nault) [RHEL-51052] {CVE-2024-41044} - leds: trigger: Unregister sysfs attributes before calling deactivate() (CKI Backport Bot) [RHEL-54834] {CVE-2024-43830} - crypto: bcm - Fix pointer arithmetic (cki-backport-bot) [RHEL-44108] {CVE-2024-38579} - scsi: qedf: Ensure the copied buf is NUL terminated (John Meneghini) [RHEL-44195] {CVE-2024-38559} - x86/bhi: Avoid warning in #DB handler due to BHI mitigation (Waiman Long) [RHEL-53657] {CVE-2024-42240} - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (CKI Backport Bot) [RHEL-47529] {CVE-2024-40901} - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (CKI Backport Bot) [RHEL-39843] {CVE-2024-36902} - net: usb: ax88179_178a: improve link status logs (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: improve reset check (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: fix link status when link is set to down/up (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: avoid writing the mac address before first reading (Jose Ignacio Tornos Martinez) [RHEL-45167] - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - media: cec: cec-api: add locking in cec_release() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid confusing "transmit timed out" message (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid recursive cec_claim_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: remove length check of Timer Status (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: count low-drive, error and arb-lost conditions (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add note about *_from_edid() function usage in drm (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_unconfigured() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_nb_transmit_canceled() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: don't set last_initiator if tx in progress (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: disable adapter in cec_devnode_unregister (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: not all messages were passed on when monitoring (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add support for Absolute Volume Control (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: log when claiming LA fails unexpectedly (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: drop activate_cnt, use state info instead (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: reconfigure if the PA changes during configuration (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: fix is_configuring state (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: stop trying LAs on CEC_TX_STATUS_TIMEOUT (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't unconfigure if already unconfigured (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add optional adap_configured callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add xfer_timeout_ms field (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: use call_op and check for !unregistered (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix interrupt en/disable handling (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: drop unused 'enabled' field from struct cec_pin (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix off-by-one SFT check (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: rename timer overrun variables (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: correctly pass on reply results (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: abort if the current transmit was canceled (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: call enable_adap on s_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: media/cec.h: document cec_adapter fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix a deadlock situation (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: safely unhook lists in cec_data (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: copy sequence field for the reply (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix trivial style warnings (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: add 'unregistered' checks (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't use flush_scheduled_work() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: Use fallthrough pseudo-keyword (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: remove unused waitq and phys_addrs fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: silence shift wrapping warning in __cec_s_log_addrs() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: move the core to a separate directory (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - net/iucv: Avoid explicit cpumask var allocation on stack (CKI Backport Bot) [RHEL-51631] {CVE-2024-42094} - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (Dick Kennedy) [RHEL-40400] - KVM: selftests: Make hyperv_clock require TSC based system clocksource (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Run clocksource dependent tests with hyperv_clocksource_tsc_page too (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Use generic sys_clocksource_is_tsc() in vmx_nested_tsc_scaling_test (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Generalize check_clocksource() from kvm_clock_test (Vitaly Kuznetsov) [RHEL-19027] - firmware: cs_dsp: Return error if block header overflows file (CKI Backport Bot) [RHEL-53646] {CVE-2024-42238} - firmware: cs_dsp: Validate payload length before processing block (CKI Backport Bot) [RHEL-53638] {CVE-2024-42237} - mm, slub: fix potential memoryleak in kmem_cache_open() (Waiman Long) [RHEL-38404] {CVE-2021-47466} - slub: don't panic for memcg kmem cache creation failure (Waiman Long) [RHEL-38404] {CVE-2021-47466} - wifi: ath11k: fix htt pktlog locking (Jose Ignacio Tornos Martinez) [RHEL-38317] {CVE-2023-52800} - wifi: ath11k: fix dfs radar event locking (Jose Ignacio Tornos Martinez) [RHEL-38165] {CVE-2023-52798} - lib/generic-radix-tree.c: Don't overflow in peek() (Waiman Long) [RHEL-37737] {CVE-2021-47432} - include/linux/generic-radix-tree.h: replace kernel.h with the necessary inclusions (Waiman Long) [RHEL-37737] {CVE-2021-47432} - EDAC/i10nm: Skip the absent memory controllers (Aristeu Rozanski) [RHEL-43236] - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (John Meneghini) [RHEL-38197] {CVE-2023-52809} - gfs2: Fix potential glock use-after-free on unmount (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: simplify gdlm_put_lock with out_free label (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: Remove ill-placed consistency check (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - nvme-fc: do not wait in vain when unloading module (Ewan D. Milne) [RHEL-33083] {CVE-2024-26846} - HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts (CKI Backport Bot) [RHEL-49698] {CVE-2022-48866} - scsi: qedf: Set qed_slowpath_params to zero before use (John Meneghini) [RHEL-9797] - scsi: qedf: Wait for stag work during unload (John Meneghini) [RHEL-9797] - scsi: qedf: Don't process stag work during unload and recovery (John Meneghini) [RHEL-9797] - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - mm: avoid overflows in dirty throttling logic (Audra Mitchell) [RHEL-51840] {CVE-2024-42131} - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - ACPI: fix NULL pointer dereference (Mark Langsdorf) [RHEL-37897] {CVE-2021-47289} - [rt] build kernel-rt-4.18.0-553.18.1.rt7.359.el8_10 [RHEL-53529] - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING (Ewan D. Milne) [RHEL-39805] {CVE-2024-36920} - tun: limit printing rate when illegal packet received by tun dev (Jon Maloy) [RHEL-35046] {CVE-2024-27013} - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu/mes: fix use-after-free issue (Michel Dänzer) [RHEL-44043] {CVE-2024-38581} - drm/amdgpu: Fix the null pointer when load rlc firmware (Michel Dänzer) [RHEL-30603] {CVE-2024-26649} - drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (Michel Dänzer) [RHEL-35160] {CVE-2024-27042} - net/sched: Fix UAF when resolving a clash (Xin Long) [RHEL-51014] {CVE-2024-41040} - tcp_metrics: validate source addr length (Guillaume Nault) [RHEL-52025] {CVE-2024-42154} - NFSv4/pnfs: Fix a use-after-free bug in open (Benjamin Coddington) [RHEL-35508] - NFSv4: Don't hold the layoutget locks across multiple RPC calls (Benjamin Coddington) [RHEL-35508] - scsi: qedf: Make qedf_execute_tmf() non-preemptible (John Meneghini) [RHEL-51799] {CVE-2024-42124} - Input: elantech - fix stack out of bound access in elantech_change_report_id() (CKI Backport Bot) [RHEL-41938] {CVE-2021-47097} - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (CKI Backport Bot) [RHEL-28982] {CVE-2023-52478} - drm/radeon: fix UBSAN warning in kv_dpm.c (CKI Backport Bot) [RHEL-48399] {CVE-2024-40988} - usb: core: Don't hold the device lock while sleeping in do_proc_control() (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - USB: core: Make do_proc_control() and do_proc_bulk() killable (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - scsi: qedi: Fix crash while reading debugfs attribute (CKI Backport Bot) [RHEL-48327] {CVE-2024-40978} - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CKI Backport Bot) [RHEL-48309] {CVE-2024-40977} - net: tcp: accept old ack during closing (Jamie Bainbridge) [RHEL-52433] - wifi: iwlwifi: mvm: don't read past the mfuart notifcation (CKI Backport Bot) [RHEL-48016] {CVE-2024-40941} - net/iucv: fix use after free in iucv_sock_close() (Mete Durlu) [RHEL-53988] - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (CKI Backport Bot) [RHEL-47908] {CVE-2024-40929} - Input: aiptek - properly check endpoint type (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - use descriptors of current altsetting (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - fix endpoint sanity check (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB (CKI Backport Bot) [RHEL-52373] {CVE-2024-42226} - wifi: mt76: replace skb_put with skb_put_zero (CKI Backport Bot) [RHEL-52366] {CVE-2024-42225} - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (CKI Backport Bot) [RHEL-47776] {CVE-2024-40912} - wifi: cfg80211: Lock wiphy in cfg80211_get_station (CKI Backport Bot) [RHEL-47758] {CVE-2024-40911} - VMCI: Use struct_size() in kmalloc() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() (Steve Best) [RHEL-37325] {CVE-2024-35944} - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values (Jose Ignacio Tornos Martinez) [RHEL-51761] {CVE-2024-42114} - usb: atm: cxacru: fix endpoint checking in cxacru_bind() (CKI Backport Bot) [RHEL-51442] {CVE-2024-41097} - nfs: handle error of rpc_proc_register() in init_nfs_fs() (Scott Mayhew) [RHEL-39904] {CVE-2024-36939} - drm/radeon: check bo_va->bo is non-NULL before using it (CKI Backport Bot) [RHEL-51184] {CVE-2024-41060} - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). (CKI Backport Bot) [RHEL-51027] {CVE-2024-41041} - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (CKI Backport Bot) [RHEL-50961] {CVE-2024-41035} - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). (CKI Backport Bot) [RHEL-44408] {CVE-2024-37356} - tcp: avoid too many retransmit packets (Florian Westphal) [RHEL-48627] {CVE-2024-41007} - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() (Florian Westphal) [RHEL-48627] - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Florian Westphal) [RHEL-48627] - tcp: refactor tcp_retransmit_timer() (Florian Westphal) [RHEL-48627] - tcp: exit if nothing to retransmit on RTO timeout (Florian Westphal) [RHEL-48627] - netfilter: nf_tables: Reject tables of unsupported family (Florian Westphal) [RHEL-21418] {CVE-2023-6040} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.23.1.rt7.364.el8_10 [RHEL-59541] - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002] - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924} - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042} - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070} - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898} - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301} - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976} - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540} - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284} - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857} - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924} - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983} - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854} - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936} - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093} - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961} - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880} - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244} - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984} - [rt] build kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 [RHEL-53529] - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071} - [rt] build kernel-rt-4.18.0-553.21.1.rt7.362.el8_10 [RHEL-53529] - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874] - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558} - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441} - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904} - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322} - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246} - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008} - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228} - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.23.1.rt7.364.el8_10 [RHEL-59541] - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002] - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924} - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042} - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070} - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898} - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301} - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976} - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540} - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284} - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857} - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924} - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983} - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854} - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936} - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093} - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961} - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880} - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244} - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - [rt] build kernel-rt-4.18.0-553.35.1.rt7.376.el8_10 [RHEL-72569] - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480] - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480] - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396] - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - [rt] build kernel-rt-4.18.0-553.35.1.rt7.376.el8_10 [RHEL-72569] - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480] - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480] - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396] - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - [rt] build kernel-rt-4.18.0-553.35.1.rt7.376.el8_10 [RHEL-72569] - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480] - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480] - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396] - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.5.1.rt7.346.el8_10 [RHEL-34640] - tools/power/turbostat: Fix uncore frequency file string (David Arcari) [RHEL-29238] - tools/power turbostat: Expand probe_intel_uncore_frequency() (David Arcari) [RHEL-29238] - uio: Fix use-after-free in uio_open (Ricardo Robaina) [RHEL-26232] {CVE-2023-52439} - net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (Ken Cox) [RHEL-27316] {CVE-2021-47013} - keys: Fix linking a duplicate key to a keyring's assoc_array (David Howells) [RHEL-30772] - keys: Hoist locking out of __key_link_begin() (David Howells) [RHEL-30772] - keys: Break bits out of key_unlink() (David Howells) [RHEL-30772] - keys: Change keyring_serialise_link_sem to a mutex (David Howells) [RHEL-30772] - wifi: brcm80211: handle pmk_op allocation failure (Jose Ignacio Tornos Martinez) [RHEL-35150] {CVE-2024-27048} - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work (Jose Ignacio Tornos Martinez) [RHEL-35140] {CVE-2024-27052} - wifi: iwlwifi: mvm: ensure offloading TID queue exists (Jose Ignacio Tornos Martinez) [RHEL-35130] {CVE-2024-27056} - wifi: mt76: mt7921e: fix use-after-free in free_irq() (Jose Ignacio Tornos Martinez) [RHEL-34866] {CVE-2024-26892} - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete (Jose Ignacio Tornos Martinez) [RHEL-34189] {CVE-2024-26897} - wifi: iwlwifi: mvm: fix a crash when we run out of stations (Jose Ignacio Tornos Martinez) [RHEL-31547] {CVE-2024-26693} - wifi: iwlwifi: fix double-free bug (Jose Ignacio Tornos Martinez) [RHEL-31543] {CVE-2024-26694} - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (Jose Ignacio Tornos Martinez) [RHEL-29089] {CVE-2023-52594} - wifi: rt2x00: restart beacon queue when hardware reset (Jose Ignacio Tornos Martinez) [RHEL-29093] {CVE-2023-52595} - wifi: iwlwifi: fix a memory corruption (Jose Ignacio Tornos Martinez) [RHEL-28903] {CVE-2024-26610} - [rt] build kernel-rt-4.18.0-553.4.1.rt7.345.el8_10 [RHEL-34640] - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117] - net/mlx5e: Prevent deadlock while disabling aRFS (Kamal Heib) [RHEL-35041] {CVE-2024-27014} - x86/tsc: Defer marking TSC unstable to a worker (Wander Lairson Costa) [RHEL-32676] - x86/smpboot: Make TSC synchronization function call based (Wander Lairson Costa) [RHEL-32676] - net: usb: fix possible use-after-free in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - net: usb: fix memory leak in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - [rt] build kernel-rt-4.18.0-552.3.1.rt7.344.el8_10 [RHEL-34640] - netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (Phil Sutter) [RHEL-30076] {CVE-2024-26643} - netfilter: nf_tables: disallow anonymous set with timeout flag (Phil Sutter) [RHEL-30080] {CVE-2024-26642} - selftests/bpf: Fix pyperf180 compilation failure with clang18 (Artem Savkov) [RHEL-35576] - md/raid5: fix atomicity violation in raid5_cache_count (Nigel Croxon) [RHEL-27930] {CVE-2024-23307} - usb: ulpi: Fix debugfs directory leak (Desnes Nunes) [RHEL-33287] {CVE-2024-26919} - powerpc/pseries: Fix potential memleak in papr_get_attr() (Mamatha Inamdar) [RHEL-35213] {CVE-2022-48669} - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (Desnes Nunes) [RHEL-35122] {CVE-2024-27059} - NFSv4: fairly test all delegations on a SEQ4_ revocation (Benjamin Coddington) [RHEL-34912] - USB: core: Fix deadlock in usb_deauthorize_interface() (Desnes Nunes) [RHEL-35002] {CVE-2024-26934} - usb: xhci: Add error handling in xhci_map_urb_for_dma (Desnes Nunes) [RHEL-34958] {CVE-2024-26964} - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (Ewan D. Milne) [RHEL-35076] {CVE-2024-26993} - xhci: handle isoc Babble and Buffer Overrun events properly (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - xhci: process isoc TD properly when there was a transaction error mid TD. (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - USB: core: Fix deadlock in port "disable" sysfs attribute (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - USB: core: Add hub_get() and hub_put() routines (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - netfilter: ipset: Missing gc cancellations fixed (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix performance regression in swap operation (Phil Sutter) [RHEL-30521] - netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test (Phil Sutter) [RHEL-30521] - x86/apic/x2apic: Fix a NULL pointer deref when handling a dying cpu (David Arcari) [RHEL-32516] - x86/coco: Disable 32-bit emulation by default on TDX and SEV (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Make IA32_EMULATION boot time configurable (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/elf: Make loading of 32bit processes depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Rename ignore_sysret() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/cpu: Don't write CSTAR MSR on Intel CPUs (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Introduce ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - [rt] build kernel-rt-4.18.0-552.2.1.rt7.343.el8_10 [RHEL-34640] - s390/ptrace: handle setting of fpc register correctly (Tobias Huschle) [RHEL-29106] {CVE-2023-52598} - net/smc: fix illegal rmb_desc access in SMC-D connection dump (Tobias Huschle) [RHEL-27746] {CVE-2024-26615} - wifi: mac80211: fix race condition on enabling fast-xmit (Jose Ignacio Tornos Martinez) [RHEL-31664] {CVE-2024-26779} - powerpc/fadump: make is_kdump_kernel() return false when fadump is active (Mamatha Inamdar) [RHEL-24401] - vmcore: remove dependency with is_kdump_kernel() for exporting vmcore (Mamatha Inamdar) [RHEL-24401] - mtd: require write permissions for locking and badblock ioctls (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - mtd: properly check all write ioctls for permissions (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - pid: take a reference when initializing `cad_pid` (Waiman Long) [RHEL-29420] {CVE-2021-47118} - i2c: i801: Don't generate an interrupt on bus reset (Prarit Bhargava) [RHEL-30325] {CVE-2021-47153} - RDMA/srpt: Do not register event handler until srpt device is fully setup (Kamal Heib) [RHEL-33224] {CVE-2024-26872} - ceph: switch to corrected encoding of max_xattr_size in mdsmap (Xiubo Li) [RHEL-26723] - ceph: switch to use cap_delay_lock for the unlink delay list (Xiubo Li) [RHEL-32870] - ceph: pass ino# instead of old_dentry if it's disconnected (Xiubo Li) [RHEL-32870] - fat: fix uninitialized field in nostale filehandles (Andrey Albershteyn) [RHEL-33186 RHEL-35108] {CVE-2024-26973} - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (Andrey Albershteyn) [RHEL-33186] {CVE-2024-26901} - idpf: limit the support to GCP only (Michal Schmidt) [RHEL-15652] - redhat/configs: enable CONFIG_IDPF (Michal Schmidt) [RHEL-15652] - idpf: remove the use of ETHTOOL_RING_USE_TCP_DATA_SPLIT (Michal Schmidt) [RHEL-15652] - idpf: workaround for unavailable skb page recycling (Michal Schmidt) [RHEL-15652] - idpf: always allocate a full page (Michal Schmidt) [RHEL-15652] - idpf: remove page pool stats code (Michal Schmidt) [RHEL-15652] - idpf: add minimal macros for __free(kfree) to work (Michal Schmidt) [RHEL-15652] - idpf: fixup include paths for RHEL 8 (Michal Schmidt) [RHEL-15652] - idpf: fix kernel panic on unknown packet types (Michal Schmidt) [RHEL-15652] - idpf: disable local BH when scheduling napi for marker packets (Michal Schmidt) [RHEL-15652] - idpf: remove dealloc vector msg err in idpf_intr_rel (Michal Schmidt) [RHEL-15652] - idpf: fix minor controlq issues (Michal Schmidt) [RHEL-15652] - idpf: prevent deinit uninitialized virtchnl core (Michal Schmidt) [RHEL-15652] - idpf: cleanup virtchnl cruft (Michal Schmidt) [RHEL-15652] - idpf: refactor idpf_recv_mb_msg (Michal Schmidt) [RHEL-15652] - idpf: add async_handler for MAC filter messages (Michal Schmidt) [RHEL-15652] - idpf: refactor remaining virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor queue related virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor vport virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: implement virtchnl transaction manager (Michal Schmidt) [RHEL-15652] - idpf: add idpf_virtchnl.h (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler padding in virtchnl2_ptype struct (Michal Schmidt) [RHEL-15652] - idpf: distinguish vports by the dev_port attribute (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler introduced padding in virtchnl2_rss_key struct (Michal Schmidt) [RHEL-15652] - idpf: fix corrupted frames and skb leaks in singleq mode (Michal Schmidt) [RHEL-15652] - idpf: refactor some missing field get/prep conversions (Michal Schmidt) [RHEL-15652] - idpf: add get/set for Ethtool's header split ringparam (Michal Schmidt) [RHEL-15652] - idpf: fix potential use-after-free in idpf_tso() (Michal Schmidt) [RHEL-15652] - idpf: cancel mailbox work in error path (Michal Schmidt) [RHEL-15652] - idpf: set scheduling mode for completion queue (Michal Schmidt) [RHEL-15652] - idpf: add SRIOV support and other ndo_ops (Michal Schmidt) [RHEL-15652] - idpf: add ethtool callbacks (Michal Schmidt) [RHEL-15652] - idpf: add singleq start_xmit and napi poll (Michal Schmidt) [RHEL-15652] - idpf: add RX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add TX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add splitq start_xmit (Michal Schmidt) [RHEL-15652] - idpf: initialize interrupts and enable vport (Michal Schmidt) [RHEL-15652] - idpf: configure resources for RX queues (Michal Schmidt) [RHEL-15652] - idpf: configure resources for TX queues (Michal Schmidt) [RHEL-15652] - idpf: add ptypes and MAC filter support (Michal Schmidt) [RHEL-15652] - idpf: add create vport and netdev configuration (Michal Schmidt) [RHEL-15652] - idpf: add core init and interrupt request (Michal Schmidt) [RHEL-15652] - idpf: add controlq init and reset checks (Michal Schmidt) [RHEL-15652] - idpf: add module register and probe functionality (Michal Schmidt) [RHEL-15652] - virtchnl: add virtchnl version 2 ops (Michal Schmidt) [RHEL-15652] - net: netdev_queue: netdev_txq_completed_mb(): fix wake condition (Michal Schmidt) [RHEL-15652] - net: piggy back on the memory barrier in bql when waking queues (Michal Schmidt) [RHEL-15652] - net: provide macros for commonly copied lockless queue stop/wake code (Michal Schmidt) [RHEL-15652] - [rt] build kernel-rt-4.18.0-552.1.1.rt7.342.el8_10 [RHEL-34640] - build: Update RTBZ for 8.10 z-stream builds (Denys Vlasenko) - redhat: set DIST to el8_10 and ZSTREAM to yes for 8.10 (Denys Vlasenko) - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (Prarit Bhargava) [RHEL-32590] {CVE-2021-47185} - net: mana: Fix Rx DMA datasize and skb_over_panic (Cathy Avery) [RHEL-32579] - RDMA/srpt: Support specifying the srpt_service_guid parameter (Kamal Heib) [RHEL-31710] {CVE-2024-26744} - RDMA/qedr: Fix qedr_create_user_qp error flow (Kamal Heib) [RHEL-31714] {CVE-2024-26743} - hwmon: (coretemp) Fix out-of-bounds memory access (David Arcari) [RHEL-31305] {CVE-2024-26664} - RDMA/irdma: Fix KASAN issue with tasklet (Kamal Heib) [RHEL-15776] - net: bridge: use DEV_STATS_INC() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: Fix unwanted sign extension in netdev_stats_to_stats64() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: add atomic_long_t to net_device_stats fields (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net/sched: act_ct: fix skb leak and crash on ooo frags (Xin Long) [RHEL-29467] {CVE-2023-52610} - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Jose Ignacio Tornos Martinez) [RHEL-28015] {CVE-2023-52528} - RDMA/core: Fix uninit-value access in ib_get_eth_speed() (Kamal Heib) [RHEL-30130] - RDMA/core: Get IB width and speed from netdev (Kamal Heib) [RHEL-30130] - cpufreq: intel_pstate: Add Emerald Rapids support in no-HWP mode (Prarit Bhargava) [RHEL-29444] - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add (Mamatha Inamdar) [RHEL-29118] {CVE-2023-52607} - powerpc/lib: Validate size for vector operations (Mamatha Inamdar) [RHEL-29114] {CVE-2023-52606} - usb: hub: Guard against accesses to uninitialized BOS descriptors (Desnes Nunes) [RHEL-28986] {CVE-2023-52477} - media: uvcvideo: Fix OOB read (Desnes Nunes) [RHEL-27940] {CVE-2023-52565} - media: pvrusb2: fix use after free on context disconnection (Desnes Nunes) [RHEL-26498] {CVE-2023-52445} - i2c: i801: Fix block process call transactions (Prarit Bhargava) [RHEL-26478] {CVE-2024-26593} - overlay: disable EVM (Coiby Xu) [RHEL-19863] - evm: add support to disable EVM on unsupported filesystems (Coiby Xu) [RHEL-19863] - evm: don't copy up 'security.evm' xattr (Coiby Xu) [RHEL-19863] - net: ena: Remove ena_select_queue (Kamal Heib) [RHEL-14286] - media: dvbdev: Fix memory leak in dvb_media_device_free() (Prarit Bhargava) [RHEL-27254] {CVE-2020-36777} - gfs2: Fix invalid metadata access in punch_hole (Andrew Price) [RHEL-28784] - i2c: Fix a potential use after free (Prarit Bhargava) [RHEL-26849] {CVE-2019-25162} - i2c: validate user data in compat ioctl (Prarit Bhargava) [RHEL-27022] {CVE-2021-46934} - platform/x86: think-lmi: Fix reference leak (Prarit Bhargava) [RHEL-28030] {CVE-2023-52520} - vhost: use kzalloc() instead of kmalloc() followed by memset() (Jon Maloy) [RHEL-21505] {CVE-2024-0340} - RDMA/siw: Fix connection failure handling (Kamal Heib) [RHEL-28042] {CVE-2023-52513} - vt: fix memory overlapping when deleting chars in the buffer (Waiman Long) [RHEL-27778 RHEL-27779] {CVE-2022-48627} - x86/fpu: Stop relying on userspace for info to fault in xsave buffer (Steve Best) [RHEL-26669] {CVE-2024-26603} - mptcp: fix double-free on socket dismantle (Davide Caratti) [RHEL-22773] {CVE-2024-26782} - crypto: akcipher - Disable signing and decryption (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: akcipher - default implementations for request callbacks (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: testmgr - split akcipher tests by a key type (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - workqueue: Warn when a rescuer could not be created (Waiman Long) [RHEL-22136] - RDMA/cma: Avoid GID lookups on iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/cma: Deduplicate error flow in cma_validate_port() (Benjamin Coddington) [RHEL-12456] - RDMA/core: Set gid_attr.ndev for iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/siw: Fabricate a GID on tun and loopback devices (Benjamin Coddington) [RHEL-12456] - eventpoll: fix missing wakeup for ovflist in ep_poll_callback (Luis Claudio R. Goncalves) [RHEL-23022] - [rt] build kernel-rt-4.18.0-552.rt7.341.el8 [RHEL-5332] - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248] - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248] - [rt] build kernel-rt-4.18.0-551.rt7.340.el8 [RHEL-5332] - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742} - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992] - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992] - [rt] build kernel-rt-4.18.0-550.rt7.339.el8 [RHEL-5332] - mm/sparsemem: fix race in accessing memory_section->usage (Waiman Long) [RHEL-28875 RHEL-28876] {CVE-2023-52489} - mm: use __pfn_to_section() instead of open coding it (Waiman Long) [RHEL-28875] {CVE-2023-52489} - [rt] build kernel-rt-4.18.0-549.rt7.338.el8 [RHEL-5332] - dm-integrity: align the outgoing bio in integrity_recheck (Benjamin Marzinski) [RHEL-29678] - dm-integrity: fix a memory leak when rechecking the data (Benjamin Marzinski) [RHEL-29678] - RDMA/mana_ib: Add CQ interrupt support for RAW QP (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: query device capabilities (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: register RDMA device with GDMA (Maxim Levitsky) [RHEL-23934] - net: mana: add msix index sharing between EQs (Maxim Levitsky) [RHEL-23934] - net: mana: Fix spelling mistake "enforecement" -> "enforcement" (Maxim Levitsky) [RHEL-23934] - net :mana :Add remaining GDMA stats for MANA to ethtool (Maxim Levitsky) [RHEL-23934] - net: mana: Fix oversized sge0 for GSO packets (Maxim Levitsky) [RHEL-23934] - net: mana: Fix TX CQE error handling (Maxim Levitsky) [RHEL-23934] - net: mana: Add gdma stats to ethtool output for mana (Maxim Levitsky) [RHEL-23934] - net: mana: Fix MANA VF unload when hardware is unresponsive (Maxim Levitsky) [RHEL-23934] - net: mana: Configure hwc timeout from hardware (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (Maxim Levitsky) [RHEL-23934] - [rt] build kernel-rt-4.18.0-548.rt7.337.el8 [RHEL-5332] - gitlab-ci: enable arm64/s390x/ppc64le debug builds (Michael Hofmann) - arm64: Add missing bits of AmpereOne Spectre-BHB mitigation (Mark Salter) [RHEL-29005] - [rt] enable CONFIG_DRM_MGAG200_IOBURST_WORKAROUND (Jocelyn Falempe) [RHEL-13214] - drm/mgag200: Add a workaround for low-latency (Jocelyn Falempe) [RHEL-13214] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - [rt] build kernel-rt-4.18.0-553.8.1.rt7.349.el8_10 [RHEL-40882] - udf: Fix NULL pointer dereference in udf_symlink function (Pavel Reichl) [RHEL-37769] {CVE-2021-47353} - net: ti: fix UAF in tlan_remove_one (Jose Ignacio Tornos Martinez) [RHEL-38940] {CVE-2021-47310} - ARM: footbridge: fix PCI interrupt mapping (Myron Stowe) [RHEL-26971] {CVE-2021-46909} - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (Kamal Heib) [RHEL-37454] {CVE-2024-36004} - net/mlx5e: Fix mlx5e_priv_init() cleanup flow (Kamal Heib) [RHEL-37424] {CVE-2024-35959} - net/mlx5: Properly link new fs rules into the tree (Kamal Heib) [RHEL-37420] {CVE-2024-35960} - net/mlx5e: fix a potential double-free in fs_any_create_groups (Kamal Heib) [RHEL-37091] {CVE-2023-52667} - net: ena: Fix incorrect descriptor free behavior (Kamal Heib) [RHEL-37428] {CVE-2024-35958} - mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - mISDN: fix possible use-after-free in HFC_cleanup() (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - implement dh fallback for primes > 4K (Vladis Dronov) [RHEL-35106] - crypto: qat - avoid division by zero (Vladis Dronov) [RHEL-35106] - crypto: qat - resolve race condition during AER recovery (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - use kcalloc_node() instead of kzalloc_node() (Vladis Dronov) [RHEL-35106] - [rt] Enable CONFIG_DRM_MGAG200_DISABLE_WRITECOMBINE (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Add an option to disable Write-Combine (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Fix caching setup for remapped video memory (Jocelyn Falempe) [RHEL-36172] - Revert "drm/mgag200: Add a workaround for low-latency" (Jocelyn Falempe) [RHEL-36172] - mptcp: fix data re-injection from stale subflow (Davide Caratti) [RHEL-33133] {CVE-2024-26826} - ipv6: sr: fix incorrect unregister order (Hangbin Liu) [RHEL-31730] - ipv6: sr: fix possible use-after-free and null-ptr-deref (Hangbin Liu) [RHEL-31730] {CVE-2024-26735} - net/bnx2x: Prevent access to a freed page in page_pool (Michal Schmidt) [RHEL-14195 RHEL-33243] {CVE-2024-26859} - bnx2x: new flag for track HW resource allocation (Michal Schmidt) [RHEL-14195 RHEL-33243] - bnx2x: fix page fault following EEH recovery (Michal Schmidt) [RHEL-14195 RHEL-33243] - x86: KVM: SVM: always update the x2avic msr interception (Maxim Levitsky) [RHEL-15495] {CVE-2023-5090} - EDAC/thunderx: Fix possible out-of-bounds string access (Aristeu Rozanski) [RHEL-26573] {CVE-2023-52464} - [rt] build kernel-rt-4.18.0-553.7.1.rt7.348.el8_10 [RHEL-34640] - net: qcom/emac: fix UAF in emac_remove (Ken Cox) [RHEL-37834] {CVE-2021-47311} - perf/core: Bail out early if the request AUX area is out of bound (Michael Petlan) [RHEL-38268] {CVE-2023-52835} - crypto: pcrypt - Fix hungtask for PADATA_RESET (Herbert Xu) [RHEL-38171] {CVE-2023-52813} - drm/amdgpu: fix use-after-free bug (Jocelyn Falempe) [RHEL-31240] {CVE-2024-26656} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash (Ivan Vecera) [RHEL-37008] {CVE-2024-35854} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update (Ivan Vecera) [RHEL-37004] {CVE-2024-35855} - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (Ivan Vecera) [RHEL-37012] {CVE-2024-35853} - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work (Ivan Vecera) [RHEL-37016] {CVE-2024-35852} - mlxsw: spectrum_acl_tcam: Fix warning during rehash (Ivan Vecera) [RHEL-37480] {CVE-2024-36007} - can: peak_pci: peak_pci_remove(): fix UAF (Jose Ignacio Tornos Martinez) [RHEL-38419] {CVE-2021-47456} - usbnet: fix error return code in usbnet_probe() (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - usbnet: sanity check for maxpacket (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - net/mlx5e: fix a double-free in arfs_create_groups (Kamal Heib) [RHEL-36920] {CVE-2024-35835} - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds (Jose Ignacio Tornos Martinez) [RHEL-38220] {CVE-2023-52878} - net: cdc_eem: fix tx fixup skb leak (Jose Ignacio Tornos Martinez) [RHEL-38080] {CVE-2021-47236} - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Jose Ignacio Tornos Martinez) [RHEL-38113] {CVE-2023-52703} - usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() (Desnes Nunes) [RHEL-38248] {CVE-2023-52877} - usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (Desnes Nunes) [RHEL-38240] {CVE-2023-52781} - gro: fix ownership transfer (Xin Long) [RHEL-37226] {CVE-2024-35890} - tipc: fix kernel warning when sending SYN message (Xin Long) [RHEL-38109] {CVE-2023-52700} - erspan: make sure erspan_base_hdr is present in skb->head (Xin Long) [RHEL-37230] {CVE-2024-35888} - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() (Bryan Gurney) [RHEL-17366] - scsi: mpi3mr: Sanitise num_phys (Bryan Gurney) [RHEL-17366] - netfilter: nf_tables: use timestamp to check for set element timeout (Phil Sutter) [RHEL-38023] {CVE-2024-27397} - net/ipv6: SKB symmetric hash should incorporate transport ports (Sabrina Dubroca) [RHEL-32061] - crypto: s390/aes - Fix buffer overread in CTR mode (Herbert Xu) [RHEL-37089] {CVE-2023-52669} - net: Save and restore msg_namelen in sock_sendmsg (Jamie Bainbridge) [RHEL-35893] - net: prevent address rewrite in kernel_bind() (Jamie Bainbridge) [RHEL-35893] - net: prevent rewrite of msg_name in sock_sendmsg() (Jamie Bainbridge) [RHEL-35893] - net: replace calls to sock->ops->connect() with kernel_connect() (Jamie Bainbridge) [RHEL-35893] - net: Avoid address overwrite in kernel_connect (Jamie Bainbridge) [RHEL-35893] - wifi: iwlwifi: dbg-tlv: ensure NUL termination (Jose Ignacio Tornos Martinez) [RHEL-37026] {CVE-2024-35845} - wifi: mac80211: fix potential sta-link leak (Jose Ignacio Tornos Martinez) [RHEL-36916] {CVE-2024-35838} - wifi: nl80211: reject iftype change with mesh ID change (Jose Ignacio Tornos Martinez) [RHEL-36884] {CVE-2024-27410} - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (Jose Ignacio Tornos Martinez) [RHEL-36807] {CVE-2024-35789} - Bluetooth: Avoid potential use-after-free in hci_error_reset (David Marlin) [RHEL-31826] {CVE-2024-26801} - tls: disable async encrypt/decrypt (Sabrina Dubroca) [RHEL-26362 RHEL-26409 RHEL-26420] {CVE-2024-26585 CVE-2024-26583 CVE-2024-26584} - Squashfs: check the inode number is not the invalid value of zero (Phillip Lougher) [RHEL-35096] {CVE-2024-26982} - ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/msg.c: update and document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/sem.c: document and update memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: update/document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: remove duplicated code (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (Kamal Heib) [RHEL-30582] {CVE-2023-52626} - Revert "ACPI: bus: Rework system-level device notification handling" (Prarit Bhargava) [RHEL-21486] - hwrng: core - Fix page fault dead lock on mmap-ed hwrng (Prarit Bhargava) [RHEL-29485] {CVE-2023-52615} - [rt] build kernel-rt-4.18.0-553.6.1.rt7.347.el8_10 [RHEL-34640] - cxgb4: Properly lock TX queue for the selftest. (John B. Wyatt IV) [RHEL-8779] - powerpc/powernv: Add a null pointer check in opal_event_init() (Mamatha Inamdar) [RHEL-37058] {CVE-2023-52686} - crypto: rsa - add a check for allocation failure (Vladis Dronov) [RHEL-35361] - crypto: rsa - allow only odd e and restrict value in FIPS mode (Vladis Dronov) [RHEL-35361] - KEYS: use kfree_sensitive with key (Vladis Dronov) [RHEL-35361] - lib/mpi: Extend the MPI library (only mpi_*_bit() part) (Vladis Dronov) [RHEL-35361] - net: ip_tunnel: prevent perpetual headroom growth (Felix Maurer) [RHEL-31814] {CVE-2024-26804} - s390/cpum_cf: make crypto counters upward compatible across machine types (Tobias Huschle) [RHEL-36048] - RDMA/mlx5: Fix fortify source warning while accessing Eth segment (Kamal Heib) [RHEL-33162] {CVE-2024-26907} - ovl: fix leaked dentry (Miklos Szeredi) [RHEL-27306] {CVE-2021-46972} - x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - x86/mm/vsyscall: Consider vsyscall page part of user address space (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - x86/mm: Add vsyscall address helper (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - mm/swap: fix race when skipping swapcache (Rafael Aquini) [RHEL-31644] {CVE-2024-26759} - swap: fix do_swap_page() race with swapoff (Rafael Aquini) [RHEL-31644] {CVE-2024-26759} - mm/swapfile: use percpu_ref to serialize against concurrent swapoff (Rafael Aquini) [RHEL-31644] {CVE-2024-26759} - mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions() (Rafael Aquini) [RHEL-29294] {CVE-2023-52560} - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr (Jiri Benc) [RHEL-29783] - block: null_blk: Fix handling of fake timeout request (Ming Lei) [RHEL-8130] - null_blk: fix poll request timeout handling (Ming Lei) [RHEL-8130] - block: null_blk: end timed out poll request (Ming Lei) [RHEL-8130] - block: null_blk: only set set->nr_maps as 3 if active poll_queues is > 0 (Ming Lei) [RHEL-8130] - null_blk: allow zero poll queues (Ming Lei) [RHEL-8130] - null_blk: Fix handling of submit_queues and poll_queues attributes (Ming Lei) [RHEL-8130] - null_blk: poll queue support (Ming Lei) [RHEL-8130] - null_blk: fix command timeout completion handling (Ming Lei) [RHEL-8130] - platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (Prarit Bhargava) [RHEL-27790] {CVE-2021-47073} - Bluetooth: avoid memcmp() out of bounds warning (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: hci_event: Fix coding style (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: hci_event: Fix using memcmp when comparing keys (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: Reject connection with the device which has same BD_ADDR (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: hci_event: Ignore NULL link key (David Marlin) [RHEL-3017] {CVE-2020-26555} - ppp_async: limit MRU to 64K (Guillaume Nault) [RHEL-31353] {CVE-2024-26675} - powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (Mamatha Inamdar) [RHEL-37078] {CVE-2023-52675} - tcp: do not accept ACK of bytes we never sent (Xin Long) [RHEL-21952] - [rt] build kernel-rt-4.18.0-553.5.1.rt7.346.el8_10 [RHEL-34640] - tools/power/turbostat: Fix uncore frequency file string (David Arcari) [RHEL-29238] - tools/power turbostat: Expand probe_intel_uncore_frequency() (David Arcari) [RHEL-29238] - uio: Fix use-after-free in uio_open (Ricardo Robaina) [RHEL-26232] {CVE-2023-52439} - net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (Ken Cox) [RHEL-27316] {CVE-2021-47013} - keys: Fix linking a duplicate key to a keyring's assoc_array (David Howells) [RHEL-30772] - keys: Hoist locking out of __key_link_begin() (David Howells) [RHEL-30772] - keys: Break bits out of key_unlink() (David Howells) [RHEL-30772] - keys: Change keyring_serialise_link_sem to a mutex (David Howells) [RHEL-30772] - wifi: brcm80211: handle pmk_op allocation failure (Jose Ignacio Tornos Martinez) [RHEL-35150] {CVE-2024-27048} - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work (Jose Ignacio Tornos Martinez) [RHEL-35140] {CVE-2024-27052} - wifi: iwlwifi: mvm: ensure offloading TID queue exists (Jose Ignacio Tornos Martinez) [RHEL-35130] {CVE-2024-27056} - wifi: mt76: mt7921e: fix use-after-free in free_irq() (Jose Ignacio Tornos Martinez) [RHEL-34866] {CVE-2024-26892} - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete (Jose Ignacio Tornos Martinez) [RHEL-34189] {CVE-2024-26897} - wifi: iwlwifi: mvm: fix a crash when we run out of stations (Jose Ignacio Tornos Martinez) [RHEL-31547] {CVE-2024-26693} - wifi: iwlwifi: fix double-free bug (Jose Ignacio Tornos Martinez) [RHEL-31543] {CVE-2024-26694} - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (Jose Ignacio Tornos Martinez) [RHEL-29089] {CVE-2023-52594} - wifi: rt2x00: restart beacon queue when hardware reset (Jose Ignacio Tornos Martinez) [RHEL-29093] {CVE-2023-52595} - wifi: iwlwifi: fix a memory corruption (Jose Ignacio Tornos Martinez) [RHEL-28903] {CVE-2024-26610} - [rt] build kernel-rt-4.18.0-553.4.1.rt7.345.el8_10 [RHEL-34640] - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117] - net/mlx5e: Prevent deadlock while disabling aRFS (Kamal Heib) [RHEL-35041] {CVE-2024-27014} - x86/tsc: Defer marking TSC unstable to a worker (Wander Lairson Costa) [RHEL-32676] - x86/smpboot: Make TSC synchronization function call based (Wander Lairson Costa) [RHEL-32676] - net: usb: fix possible use-after-free in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - net: usb: fix memory leak in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - [rt] build kernel-rt-4.18.0-552.3.1.rt7.344.el8_10 [RHEL-34640] - netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (Phil Sutter) [RHEL-30076] {CVE-2024-26643} - netfilter: nf_tables: disallow anonymous set with timeout flag (Phil Sutter) [RHEL-30080] {CVE-2024-26642} - selftests/bpf: Fix pyperf180 compilation failure with clang18 (Artem Savkov) [RHEL-35576] - md/raid5: fix atomicity violation in raid5_cache_count (Nigel Croxon) [RHEL-27930] {CVE-2024-23307} - usb: ulpi: Fix debugfs directory leak (Desnes Nunes) [RHEL-33287] {CVE-2024-26919} - powerpc/pseries: Fix potential memleak in papr_get_attr() (Mamatha Inamdar) [RHEL-35213] {CVE-2022-48669} - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (Desnes Nunes) [RHEL-35122] {CVE-2024-27059} - NFSv4: fairly test all delegations on a SEQ4_ revocation (Benjamin Coddington) [RHEL-34912] - USB: core: Fix deadlock in usb_deauthorize_interface() (Desnes Nunes) [RHEL-35002] {CVE-2024-26934} - usb: xhci: Add error handling in xhci_map_urb_for_dma (Desnes Nunes) [RHEL-34958] {CVE-2024-26964} - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (Ewan D. Milne) [RHEL-35076] {CVE-2024-26993} - xhci: handle isoc Babble and Buffer Overrun events properly (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - xhci: process isoc TD properly when there was a transaction error mid TD. (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - USB: core: Fix deadlock in port "disable" sysfs attribute (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - USB: core: Add hub_get() and hub_put() routines (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - netfilter: ipset: Missing gc cancellations fixed (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix performance regression in swap operation (Phil Sutter) [RHEL-30521] - netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test (Phil Sutter) [RHEL-30521] - x86/apic/x2apic: Fix a NULL pointer deref when handling a dying cpu (David Arcari) [RHEL-32516] - x86/coco: Disable 32-bit emulation by default on TDX and SEV (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Make IA32_EMULATION boot time configurable (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/elf: Make loading of 32bit processes depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Rename ignore_sysret() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/cpu: Don't write CSTAR MSR on Intel CPUs (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Introduce ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - [rt] build kernel-rt-4.18.0-552.2.1.rt7.343.el8_10 [RHEL-34640] - s390/ptrace: handle setting of fpc register correctly (Tobias Huschle) [RHEL-29106] {CVE-2023-52598} - net/smc: fix illegal rmb_desc access in SMC-D connection dump (Tobias Huschle) [RHEL-27746] {CVE-2024-26615} - wifi: mac80211: fix race condition on enabling fast-xmit (Jose Ignacio Tornos Martinez) [RHEL-31664] {CVE-2024-26779} - powerpc/fadump: make is_kdump_kernel() return false when fadump is active (Mamatha Inamdar) [RHEL-24401] - vmcore: remove dependency with is_kdump_kernel() for exporting vmcore (Mamatha Inamdar) [RHEL-24401] - mtd: require write permissions for locking and badblock ioctls (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - mtd: properly check all write ioctls for permissions (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - pid: take a reference when initializing `cad_pid` (Waiman Long) [RHEL-29420] {CVE-2021-47118} - i2c: i801: Don't generate an interrupt on bus reset (Prarit Bhargava) [RHEL-30325] {CVE-2021-47153} - RDMA/srpt: Do not register event handler until srpt device is fully setup (Kamal Heib) [RHEL-33224] {CVE-2024-26872} - ceph: switch to corrected encoding of max_xattr_size in mdsmap (Xiubo Li) [RHEL-26723] - ceph: switch to use cap_delay_lock for the unlink delay list (Xiubo Li) [RHEL-32870] - ceph: pass ino# instead of old_dentry if it's disconnected (Xiubo Li) [RHEL-32870] - fat: fix uninitialized field in nostale filehandles (Andrey Albershteyn) [RHEL-33186 RHEL-35108] {CVE-2024-26973} - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (Andrey Albershteyn) [RHEL-33186] {CVE-2024-26901} - idpf: limit the support to GCP only (Michal Schmidt) [RHEL-15652] - redhat/configs: enable CONFIG_IDPF (Michal Schmidt) [RHEL-15652] - idpf: remove the use of ETHTOOL_RING_USE_TCP_DATA_SPLIT (Michal Schmidt) [RHEL-15652] - idpf: workaround for unavailable skb page recycling (Michal Schmidt) [RHEL-15652] - idpf: always allocate a full page (Michal Schmidt) [RHEL-15652] - idpf: remove page pool stats code (Michal Schmidt) [RHEL-15652] - idpf: add minimal macros for __free(kfree) to work (Michal Schmidt) [RHEL-15652] - idpf: fixup include paths for RHEL 8 (Michal Schmidt) [RHEL-15652] - idpf: fix kernel panic on unknown packet types (Michal Schmidt) [RHEL-15652] - idpf: disable local BH when scheduling napi for marker packets (Michal Schmidt) [RHEL-15652] - idpf: remove dealloc vector msg err in idpf_intr_rel (Michal Schmidt) [RHEL-15652] - idpf: fix minor controlq issues (Michal Schmidt) [RHEL-15652] - idpf: prevent deinit uninitialized virtchnl core (Michal Schmidt) [RHEL-15652] - idpf: cleanup virtchnl cruft (Michal Schmidt) [RHEL-15652] - idpf: refactor idpf_recv_mb_msg (Michal Schmidt) [RHEL-15652] - idpf: add async_handler for MAC filter messages (Michal Schmidt) [RHEL-15652] - idpf: refactor remaining virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor queue related virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor vport virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: implement virtchnl transaction manager (Michal Schmidt) [RHEL-15652] - idpf: add idpf_virtchnl.h (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler padding in virtchnl2_ptype struct (Michal Schmidt) [RHEL-15652] - idpf: distinguish vports by the dev_port attribute (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler introduced padding in virtchnl2_rss_key struct (Michal Schmidt) [RHEL-15652] - idpf: fix corrupted frames and skb leaks in singleq mode (Michal Schmidt) [RHEL-15652] - idpf: refactor some missing field get/prep conversions (Michal Schmidt) [RHEL-15652] - idpf: add get/set for Ethtool's header split ringparam (Michal Schmidt) [RHEL-15652] - idpf: fix potential use-after-free in idpf_tso() (Michal Schmidt) [RHEL-15652] - idpf: cancel mailbox work in error path (Michal Schmidt) [RHEL-15652] - idpf: set scheduling mode for completion queue (Michal Schmidt) [RHEL-15652] - idpf: add SRIOV support and other ndo_ops (Michal Schmidt) [RHEL-15652] - idpf: add ethtool callbacks (Michal Schmidt) [RHEL-15652] - idpf: add singleq start_xmit and napi poll (Michal Schmidt) [RHEL-15652] - idpf: add RX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add TX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add splitq start_xmit (Michal Schmidt) [RHEL-15652] - idpf: initialize interrupts and enable vport (Michal Schmidt) [RHEL-15652] - idpf: configure resources for RX queues (Michal Schmidt) [RHEL-15652] - idpf: configure resources for TX queues (Michal Schmidt) [RHEL-15652] - idpf: add ptypes and MAC filter support (Michal Schmidt) [RHEL-15652] - idpf: add create vport and netdev configuration (Michal Schmidt) [RHEL-15652] - idpf: add core init and interrupt request (Michal Schmidt) [RHEL-15652] - idpf: add controlq init and reset checks (Michal Schmidt) [RHEL-15652] - idpf: add module register and probe functionality (Michal Schmidt) [RHEL-15652] - virtchnl: add virtchnl version 2 ops (Michal Schmidt) [RHEL-15652] - net: netdev_queue: netdev_txq_completed_mb(): fix wake condition (Michal Schmidt) [RHEL-15652] - net: piggy back on the memory barrier in bql when waking queues (Michal Schmidt) [RHEL-15652] - net: provide macros for commonly copied lockless queue stop/wake code (Michal Schmidt) [RHEL-15652] - [rt] build kernel-rt-4.18.0-552.1.1.rt7.342.el8_10 [RHEL-34640] - build: Update RTBZ for 8.10 z-stream builds (Denys Vlasenko) - redhat: set DIST to el8_10 and ZSTREAM to yes for 8.10 (Denys Vlasenko) - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (Prarit Bhargava) [RHEL-32590] {CVE-2021-47185} - net: mana: Fix Rx DMA datasize and skb_over_panic (Cathy Avery) [RHEL-32579] - RDMA/srpt: Support specifying the srpt_service_guid parameter (Kamal Heib) [RHEL-31710] {CVE-2024-26744} - RDMA/qedr: Fix qedr_create_user_qp error flow (Kamal Heib) [RHEL-31714] {CVE-2024-26743} - hwmon: (coretemp) Fix out-of-bounds memory access (David Arcari) [RHEL-31305] {CVE-2024-26664} - RDMA/irdma: Fix KASAN issue with tasklet (Kamal Heib) [RHEL-15776] - net: bridge: use DEV_STATS_INC() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: Fix unwanted sign extension in netdev_stats_to_stats64() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: add atomic_long_t to net_device_stats fields (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net/sched: act_ct: fix skb leak and crash on ooo frags (Xin Long) [RHEL-29467] {CVE-2023-52610} - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Jose Ignacio Tornos Martinez) [RHEL-28015] {CVE-2023-52528} - RDMA/core: Fix uninit-value access in ib_get_eth_speed() (Kamal Heib) [RHEL-30130] - RDMA/core: Get IB width and speed from netdev (Kamal Heib) [RHEL-30130] - cpufreq: intel_pstate: Add Emerald Rapids support in no-HWP mode (Prarit Bhargava) [RHEL-29444] - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add (Mamatha Inamdar) [RHEL-29118] {CVE-2023-52607} - powerpc/lib: Validate size for vector operations (Mamatha Inamdar) [RHEL-29114] {CVE-2023-52606} - usb: hub: Guard against accesses to uninitialized BOS descriptors (Desnes Nunes) [RHEL-28986] {CVE-2023-52477} - media: uvcvideo: Fix OOB read (Desnes Nunes) [RHEL-27940] {CVE-2023-52565} - media: pvrusb2: fix use after free on context disconnection (Desnes Nunes) [RHEL-26498] {CVE-2023-52445} - i2c: i801: Fix block process call transactions (Prarit Bhargava) [RHEL-26478] {CVE-2024-26593} - overlay: disable EVM (Coiby Xu) [RHEL-19863] - evm: add support to disable EVM on unsupported filesystems (Coiby Xu) [RHEL-19863] - evm: don't copy up 'security.evm' xattr (Coiby Xu) [RHEL-19863] - net: ena: Remove ena_select_queue (Kamal Heib) [RHEL-14286] - media: dvbdev: Fix memory leak in dvb_media_device_free() (Prarit Bhargava) [RHEL-27254] {CVE-2020-36777} - gfs2: Fix invalid metadata access in punch_hole (Andrew Price) [RHEL-28784] - i2c: Fix a potential use after free (Prarit Bhargava) [RHEL-26849] {CVE-2019-25162} - i2c: validate user data in compat ioctl (Prarit Bhargava) [RHEL-27022] {CVE-2021-46934} - platform/x86: think-lmi: Fix reference leak (Prarit Bhargava) [RHEL-28030] {CVE-2023-52520} - vhost: use kzalloc() instead of kmalloc() followed by memset() (Jon Maloy) [RHEL-21505] {CVE-2024-0340} - RDMA/siw: Fix connection failure handling (Kamal Heib) [RHEL-28042] {CVE-2023-52513} - vt: fix memory overlapping when deleting chars in the buffer (Waiman Long) [RHEL-27778 RHEL-27779] {CVE-2022-48627} - x86/fpu: Stop relying on userspace for info to fault in xsave buffer (Steve Best) [RHEL-26669] {CVE-2024-26603} - mptcp: fix double-free on socket dismantle (Davide Caratti) [RHEL-22773] {CVE-2024-26782} - crypto: akcipher - Disable signing and decryption (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: akcipher - default implementations for request callbacks (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: testmgr - split akcipher tests by a key type (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - workqueue: Warn when a rescuer could not be created (Waiman Long) [RHEL-22136] - RDMA/cma: Avoid GID lookups on iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/cma: Deduplicate error flow in cma_validate_port() (Benjamin Coddington) [RHEL-12456] - RDMA/core: Set gid_attr.ndev for iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/siw: Fabricate a GID on tun and loopback devices (Benjamin Coddington) [RHEL-12456] - eventpoll: fix missing wakeup for ovflist in ep_poll_callback (Luis Claudio R. Goncalves) [RHEL-23022] - [rt] build kernel-rt-4.18.0-552.rt7.341.el8 [RHEL-5332] - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248] - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248] - [rt] build kernel-rt-4.18.0-551.rt7.340.el8 [RHEL-5332] - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742} - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992] - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825} - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237] - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724} - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513} - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921] - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921] - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921] - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921] - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921] - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774] - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660] - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660] - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199] - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539} - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825} - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237] - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724} - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513} - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921] - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921] - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921] - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921] - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921] - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285} - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993} - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396] - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396] - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396] - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396] - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355] - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355] - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355] - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355] - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355] - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355] - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240} - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek) - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963] - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171] - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171] - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226] - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226] - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744] - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744] - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744] - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744] - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew) [RHEL-129945] - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774] - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660] - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660] - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199] - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539} - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825} - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237] - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724} - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513} - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921] - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921] - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921] - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921] - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921] - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301} - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933} - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051} - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449] - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096} - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285} - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993} - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396] - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396] - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396] - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396] - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355] - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355] - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355] - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355] - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355] - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355] - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240} - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek) - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963] - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171] - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171] - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226] - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226] - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744] - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744] - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744] - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744] - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew) [RHEL-129945] - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774] - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660] - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660] - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199] - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539} - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - Bluetooth: hci_event: call disconnect callback before deleting conn (CKI Backport Bot) [RHEL-137039] {CVE-2023-53673} - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CKI Backport Bot) [RHEL-134423] {CVE-2025-40277} - xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 (John J Coleman) [RHEL-111354] - xen: Fix x86 sched_clock() interface for xen (John J Coleman) [RHEL-111354] - x86/xen/time: Output xen sched_clock time from 0 (John J Coleman) [RHEL-111354] - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Olga Kornievskaia) [RHEL-132819] - vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139273] {CVE-2025-40248} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ignore ndlp rport mismatch in dev_loss_tmo callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Modify handling of ADISC based on ndlp state and RPI registration (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Delete NLP_TARGET_REMOVE flag due to obsolete usage (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo callback (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Check devloss callbk done flag for potential stale NDLP ptrs (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kref imbalance on fabric ndlps from dev_loss_tmo handler (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Update PRLO handling in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Add condition to delete ndlp object after sending BLS_RJT to an ABTS (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove NLP_RCV_PLOGI early return during RSCN processing for ndlps (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Allow lpfc_plogi_confirm_nport() logic to execute for Fabric nodes (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix list_entry null check warning in lpfc_cmpl_els_plogi() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix possible file string name overflow when updating firmware (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Validate ELS LS_ACC completion payload (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove extra ndlp kref decrement in FLOGI cmpl for loop topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Revise NPIV ELS unsol rcv cmpl logic to drop ndlp based on nlp_state (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix double free in lpfc_cmpl_els_logo_acc() caused by lpfc_nlp_not_used() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Move scsi_host_template outside dynamically allocated/freed phba (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fill in missing ndlp kref puts in error paths (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login (Ewan D. Milne) [RHEL-32324] - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301} - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933} - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051} - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449] - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096} - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285} - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993} - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396] - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396] - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396] - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396] - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355] - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355] - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355] - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355] - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355] - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355] - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240} - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek) - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963] - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171] - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171] - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226] - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226] - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744] - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744] - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744] - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744] - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew) [RHEL-129945] - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117] - [rt] build kernel-rt-4.18.0-552.rt7.341.el8 [RHEL-5332] - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248] - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248] - [rt] build kernel-rt-4.18.0-551.rt7.340.el8 [RHEL-5332] - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742} - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992] - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992] - [rt] build kernel-rt-4.18.0-550.rt7.339.el8 [RHEL-5332] - mm/sparsemem: fix race in accessing memory_section->usage (Waiman Long) [RHEL-28875 RHEL-28876] {CVE-2023-52489} - mm: use __pfn_to_section() instead of open coding it (Waiman Long) [RHEL-28875] {CVE-2023-52489} - [rt] build kernel-rt-4.18.0-549.rt7.338.el8 [RHEL-5332] - dm-integrity: align the outgoing bio in integrity_recheck (Benjamin Marzinski) [RHEL-29678] - dm-integrity: fix a memory leak when rechecking the data (Benjamin Marzinski) [RHEL-29678] - RDMA/mana_ib: Add CQ interrupt support for RAW QP (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: query device capabilities (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: register RDMA device with GDMA (Maxim Levitsky) [RHEL-23934] - net: mana: add msix index sharing between EQs (Maxim Levitsky) [RHEL-23934] - net: mana: Fix spelling mistake "enforecement" -> "enforcement" (Maxim Levitsky) [RHEL-23934] - net :mana :Add remaining GDMA stats for MANA to ethtool (Maxim Levitsky) [RHEL-23934] - net: mana: Fix oversized sge0 for GSO packets (Maxim Levitsky) [RHEL-23934] - net: mana: Fix TX CQE error handling (Maxim Levitsky) [RHEL-23934] - net: mana: Add gdma stats to ethtool output for mana (Maxim Levitsky) [RHEL-23934] - net: mana: Fix MANA VF unload when hardware is unresponsive (Maxim Levitsky) [RHEL-23934] - net: mana: Configure hwc timeout from hardware (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (Maxim Levitsky) [RHEL-23934] - [rt] build kernel-rt-4.18.0-548.rt7.337.el8 [RHEL-5332] - gitlab-ci: enable arm64/s390x/ppc64le debug builds (Michael Hofmann) - arm64: Add missing bits of AmpereOne Spectre-BHB mitigation (Mark Salter) [RHEL-29005] - [rt] enable CONFIG_DRM_MGAG200_IOBURST_WORKAROUND (Jocelyn Falempe) [RHEL-13214] - drm/mgag200: Add a workaround for low-latency (Jocelyn Falempe) [RHEL-13214] - [rt] build kernel-rt-4.18.0-547.rt7.336.el8 [RHEL-5332] - x86/efistub: Avoid placing the kernel below LOAD_PHYSICAL_ADDR (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Give up if memory attribute protocol returns an error (Lenny Szubowicz) [RHEL-2505] - x86/boot: Increase section and file alignment to 4k/512 (Lenny Szubowicz) [RHEL-2505] - x86/boot: Split off PE/COFF .data section (Lenny Szubowicz) [RHEL-2505] - x86/boot: Drop PE/COFF .reloc section (Lenny Szubowicz) [RHEL-2505] - x86/boot: Construct PE/COFF .text section from assembler (Lenny Szubowicz) [RHEL-2505] - x86/boot: Derive file size from _edata symbol (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed: Remove, discard, or assert for unwanted sections (Lenny Szubowicz) [RHEL-2505] - x86/boot: Check that there are no run-time relocations (Lenny Szubowicz) [RHEL-2505] - x86/boot: Discard .discard.unreachable for arch/x86/boot/compressed/vmlinux (Lenny Szubowicz) [RHEL-2505] - x86/boot: Define setup size in linker script (Lenny Szubowicz) [RHEL-2505] - x86/boot: Set EFI handover offset directly in header asm (Lenny Szubowicz) [RHEL-2505] - x86/boot: Drop references to startup_64 (Lenny Szubowicz) [RHEL-2505] - x86/boot: Drop redundant code setting the root device (Lenny Szubowicz) [RHEL-2505] - x86/build: Declutter the build output (Lenny Szubowicz) [RHEL-2505] - x86/boot: Omit compression buffer from PE/COFF image memory footprint (Lenny Szubowicz) [RHEL-2505] - x86/boot: Mark global variables as static (Lenny Szubowicz) [RHEL-2505] - efi/x86: Remove extra headroom for setup block (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove the 'bugger off' message (Lenny Szubowicz) [RHEL-2505] - x86/efi: Drop alignment flags from PE section headers (Lenny Szubowicz) [RHEL-2505] - efi: Put Linux specific magic number in the DOS header (Lenny Szubowicz) [RHEL-2505] - efi/x86: Fix the missing KASLR_FLAG bit in boot_params->hdr.loadflags (Lenny Szubowicz) [RHEL-2505] - efi/x86: Avoid physical KASLR on older Dell systems (Lenny Szubowicz) [RHEL-2505] - x86/boot: efistub: Assign global boot_params variable (Lenny Szubowicz) [RHEL-2505] - x86/boot: Rename conflicting 'boot_params' pointer to 'boot_params_ptr' (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Avoid legacy decompressor when doing EFI boot (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Perform SNP feature test while running in the firmware (Lenny Szubowicz) [RHEL-2505] - x86/sev: Do not try to parse for the CC blob on non-AMD hardware (Lenny Szubowicz) [RHEL-2505] - efi/libstub: Add limit argument to efi_random_alloc() (Lenny Szubowicz) [RHEL-2505] - arm64: efi: Limit allocations to 48-bit addressable physical region (Lenny Szubowicz) [RHEL-2505] - efi: libstub: use EFI_LOADER_CODE region when moving the kernel in memory (Lenny Szubowicz) [RHEL-2505] - arm64: efi: kaslr: Fix occasional random alloc (and boot) failure (Lenny Szubowicz) [RHEL-2505] - efi/libstub/random: Increase random alloc granularity (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Factor out kernel decompression and relocation (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Move global symbol references to C code (Lenny Szubowicz) [RHEL-2505] - decompress: Use 8 byte alignment (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Prefer EFI memory attributes protocol over DXE services (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Perform 4/5 level paging switch from the stub (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Merge trampoline cleanup with switching code (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Pass pgtable address to trampoline directly (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Only call the trampoline when changing paging levels (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Call trampoline directly from C code (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Avoid the need for a stack in the 32-bit trampoline (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Use standard calling convention for trampoline (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Call trampoline as a normal function (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Remove .bss/.pgtable from bzImage (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove run-time relocations from .head.text code (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Assign paging related global variables earlier (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Store boot_params pointer in callee save register (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Clear BSS in EFI handover protocol entrypoint (Lenny Szubowicz) [RHEL-2505] - x86/head_64: Store boot_params pointer in callee save register (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Don't rely on upper 32 bits of GPRs being preserved (Lenny Szubowicz) [RHEL-2505] - x86/head/64: Switch to KERNEL_CS as soon as new GDT is installed (Lenny Szubowicz) [RHEL-2505] - efi/libstub: Add memory attribute protocol definitions (Lenny Szubowicz) [RHEL-2505] - efi/x86: libstub: remove unused variable (Lenny Szubowicz) [RHEL-2505] - x86/boot: Robustify calling startup_{32,64}() from the decompressor code (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Simplify and clean up handover entry code (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Branch straight to kernel entry point from C code (Lenny Szubowicz) [RHEL-2505] - efi/x86: Avoid using code32_start (Lenny Szubowicz) [RHEL-2505] - efi/libstub/x86: Use Exit() boot service to exit the stub on errors (Lenny Szubowicz) [RHEL-2505] - efi: x86: Wipe setup_data on pure EFI boot (Lenny Szubowicz) [RHEL-2505] - efi: x86: Fix config name for setting the NX-compatibility flag in the PE header (Lenny Szubowicz) [RHEL-2505] - efi: x86: Set the NX-compatibility flag in the PE header (Lenny Szubowicz) [RHEL-2505] - efi/x86: Add kernel preferred address to PE header (Lenny Szubowicz) [RHEL-2505] - efi/x86: Use symbolic constants in PE header instead of bare numbers (Lenny Szubowicz) [RHEL-2505] - efi/x86: Drop redundant .bss section (Lenny Szubowicz) [RHEL-2505] - efi/x86: add headroom to decompressor BSS to account for setup block (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove run-time relocations from head_{32,64}.S (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed: Fix debug_puthex() parameter type (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Use 32-bit (zero-extended) MOV for z_output_len (Lenny Szubowicz) [RHEL-2505] - x86/boot: Use unsigned comparison for addresses (Lenny Szubowicz) [RHEL-2505] - x86/boot: Micro-optimize GDT loading instructions (Lenny Szubowicz) [RHEL-2505] - x86/boot: GDT limit value should be size - 1 (Lenny Szubowicz) [RHEL-2505] - efi/x86: Remove GDT setup from efi_main (Lenny Szubowicz) [RHEL-2505] - x86/boot: Clear direction and interrupt flags in startup_64 (Lenny Szubowicz) [RHEL-2505] - efi/x86: Don't depend on firmware GDT layout (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove KEEP_SEGMENTS support (Lenny Szubowicz) [RHEL-2505] - x86/boot: Handle malformed SRAT tables during early ACPI parsing (Lenny Szubowicz) [RHEL-2505] - efi/libstub/x86: Use mandatory 16-byte stack alignment in mixed mode (Lenny Szubowicz) [RHEL-2505] - efi/libstub/x86: Avoid globals to store context during mixed mode calls (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Disable paging at mixed mode entry (Lenny Szubowicz) [RHEL-2505] - x86: efi/random: Invoke EFI_RNG_PROTOCOL to seed the UEFI RNG table (Lenny Szubowicz) [RHEL-2505] - x86/asm: Make some functions local (Lenny Szubowicz) [RHEL-2505] - x86/boot: Annotate data appropriately (Lenny Szubowicz) [RHEL-2505] - x86/boot: Annotate local functions (Lenny Szubowicz) [RHEL-2505] - x86/asm: Make more symbols local (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Fix missing initialization in find_trampoline_placement() (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Fix boot on machines with broken E820 table (Lenny Szubowicz) [RHEL-2505] - x86, boot: Remove multiple copy of static function sanitize_boot_params() (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Remove unused variable (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Explain paging_prepare()'s return value (Lenny Szubowicz) [RHEL-2505] - x86/boot: Save several bytes in decompressor (Lenny Szubowicz) [RHEL-2505] - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (Audra Mitchell) [RHEL-20614] {CVE-2024-0841} - net/gve: update check for little-endianness in gve kconfig (Joshua Washington) [RHEL-29030] - [rt] build kernel-rt-4.18.0-546.rt7.335.el8 [RHEL-5332] - sched/membarrier: reduce the ability to hammer on sys_membarrier (Wander Lairson Costa) [RHEL-23430] {CVE-2024-26602} - NFS: Set the stable writes flag when initialising the super block (Benjamin Coddington) [RHEL-25266] - smb: client: fix OOB in receive_encrypted_standard() (Scott Mayhew) [RHEL-21685] {CVE-2024-0565} - scsi: core: Move scsi_host_busy() out of host lock if it is for per-command (Ming Lei) [RHEL-23942] - scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler (Ming Lei) [RHEL-23942] - gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump (Andrew Price) [RHEL-26501] {CVE-2023-52448} - smb: client: fix parsing of SMB3.1.1 POSIX create context (Paulo Alcantara) [RHEL-26241] {CVE-2023-52434} - smb: client: fix potential OOBs in smb2_parse_contexts() (Paulo Alcantara) [RHEL-26241] {CVE-2023-52434} - smb3: Replace smb2pdu 1-element arrays with flex-arrays (Jay Shin) [RHEL-22143] - cifs: Replace remaining 1-element arrays (Jay Shin) [RHEL-22143] - cifs: Convert struct fealist away from 1-element array (Jay Shin) [RHEL-22143] - cifs: remove unneeded 2bytes of padding from smb2 tree connect (Jay Shin) [RHEL-22143] - cifs: Replace zero-length arrays with flexible-array members (Jay Shin) [RHEL-22143] - cifs: Replace a couple of one-element arrays with flexible-array members (Jay Shin) [RHEL-22143] - cifs: fix FILE_BOTH_DIRECTORY_INFO definition (Jay Shin) [RHEL-22143] - nfsd: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - nfs: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - lockd: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - cifs: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - ceph: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - filelock: add a new locks_inode_context accessor function (Jeffrey Layton) [RHEL-27441] - dm-integrity, dm-verity: reduce stack usage for recheck (Benjamin Marzinski) [RHEL-27849] - dm-crypt: recheck the integrity tag after a failure (Benjamin Marzinski) [RHEL-27849] - dm-crypt: don't modify the data when using authenticated encryption (Benjamin Marzinski) [RHEL-27849] - dm-verity: recheck the hash after a failure (Benjamin Marzinski) [RHEL-27849] - dm-integrity: recheck the integrity tag after a failure (Benjamin Marzinski) [RHEL-27849] - [rt] build kernel-rt-4.18.0-545.rt7.334.el8 [RHEL-5332] - tracing/timerlat: Move hrtimer_init to timerlat_fd open() (John Kacur) [RHEL-26667] - tracing/perf: Fix double put of trace event when init fails (Michael Petlan) [RHEL-19537] - ipvlan: Add handling of NETDEV_UP events (Hangbin Liu) [RHEL-19098] - ceph: add ceph_cap_unlink_work to fire check_caps() immediately (Xiubo Li) [RHEL-21760] - ceph: always queue a writeback when revoking the Fb caps (Xiubo Li) [RHEL-21760] - ceph: always check dir caps asynchronously (Xiubo Li) [RHEL-21760] - nfs: fix redundant readdir request after get eof (Benjamin Coddington) [RHEL-7780] - NFSv4.1: fixup use EXCHGID4_FLAG_USE_PNFS_DS for DS server (Scott Mayhew) [RHEL-7994] - NFSv4.1: fix pnfs MDS=DS session trunking (Scott Mayhew) [RHEL-7994] - NFSv4.1: fix zero value filehandle in post open getattr (Scott Mayhew) [RHEL-7994] - NFSv4.1: use EXCHGID4_FLAG_USE_PNFS_DS for DS server (Scott Mayhew) [RHEL-7994] - x86/boot: Ignore NMIs during very early boot (Valentin Schneider) [RHEL-22749] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - vfs: use READ_ONCE() to access ->i_link (Jay Shin) [RHEL-141790] - fold generic_readlink() into its only caller (Jay Shin) [RHEL-141790] - fs/proc: fix uaf in proc_readdir_de() (Pavel Reichl) [RHEL-137093] {CVE-2025-40271} - Backport 'create an empty changelog file when changing its name' (Alexandra Hájková) - mptcp: fix race condition in mptcp_schedule_work() (Paolo Abeni) [RHEL-134443] {CVE-2025-40258} - mptcp: use mptcp_schedule_work instead of open-coding it (Paolo Abeni) [RHEL-134443] - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - tcp: minor optimization in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Kamal Heib) [RHEL-134347] {CVE-2025-38022} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - Bluetooth: hci_event: call disconnect callback before deleting conn (CKI Backport Bot) [RHEL-137039] {CVE-2023-53673} - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CKI Backport Bot) [RHEL-134423] {CVE-2025-40277} - xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 (John J Coleman) [RHEL-111354] - xen: Fix x86 sched_clock() interface for xen (John J Coleman) [RHEL-111354] - x86/xen/time: Output xen sched_clock time from 0 (John J Coleman) [RHEL-111354] - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Olga Kornievskaia) [RHEL-132819] - vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139273] {CVE-2025-40248} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ignore ndlp rport mismatch in dev_loss_tmo callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Modify handling of ADISC based on ndlp state and RPI registration (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Delete NLP_TARGET_REMOVE flag due to obsolete usage (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo callback (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Check devloss callbk done flag for potential stale NDLP ptrs (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kref imbalance on fabric ndlps from dev_loss_tmo handler (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Update PRLO handling in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Add condition to delete ndlp object after sending BLS_RJT to an ABTS (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove NLP_RCV_PLOGI early return during RSCN processing for ndlps (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Allow lpfc_plogi_confirm_nport() logic to execute for Fabric nodes (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix list_entry null check warning in lpfc_cmpl_els_plogi() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix possible file string name overflow when updating firmware (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Validate ELS LS_ACC completion payload (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove extra ndlp kref decrement in FLOGI cmpl for loop topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Revise NPIV ELS unsol rcv cmpl logic to drop ndlp based on nlp_state (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix double free in lpfc_cmpl_els_logo_acc() caused by lpfc_nlp_not_used() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Move scsi_host_template outside dynamically allocated/freed phba (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fill in missing ndlp kref puts in error paths (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login (Ewan D. Milne) [RHEL-32324] - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301} - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933} - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051} - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449] - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096} - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - vfs: use READ_ONCE() to access ->i_link (Jay Shin) [RHEL-141790] - fold generic_readlink() into its only caller (Jay Shin) [RHEL-141790] - fs/proc: fix uaf in proc_readdir_de() (Pavel Reichl) [RHEL-137093] {CVE-2025-40271} - Backport 'create an empty changelog file when changing its name' (Alexandra Hájková) - mptcp: fix race condition in mptcp_schedule_work() (Paolo Abeni) [RHEL-134443] {CVE-2025-40258} - mptcp: use mptcp_schedule_work instead of open-coding it (Paolo Abeni) [RHEL-134443] - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - tcp: minor optimization in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Kamal Heib) [RHEL-134347] {CVE-2025-38022} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - vfs: use READ_ONCE() to access ->i_link (Jay Shin) [RHEL-141790] - fold generic_readlink() into its only caller (Jay Shin) [RHEL-141790] - fs/proc: fix uaf in proc_readdir_de() (Pavel Reichl) [RHEL-137093] {CVE-2025-40271} - Backport 'create an empty changelog file when changing its name' (Alexandra Hájková) - mptcp: fix race condition in mptcp_schedule_work() (Paolo Abeni) [RHEL-134443] {CVE-2025-40258} - mptcp: use mptcp_schedule_work instead of open-coding it (Paolo Abeni) [RHEL-134443] - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - tcp: minor optimization in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Kamal Heib) [RHEL-134347] {CVE-2025-38022} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - autofs: use wake_up() instead of wake_up_interruptible(() (Ian Kent) [RHEL-143685] - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Ian Kent) [RHEL-143685] {CVE-2023-54134} - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141709] - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-136693] - audit: merge loops in __audit_inode_child() (Ricardo Robaina) [RHEL-140442] - bridge: mcast: Fix use-after-free during router port configuration (Mohammad Heib) [RHEL-138422] {CVE-2025-38248} - net/sched: Enforce that teql can only be used as root qdisc (CKI Backport Bot) [RHEL-146992] {CVE-2026-23074} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Marc Milgram) [RHEL-137838] {CVE-2025-38129} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143189] {CVE-2025-68800} - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126886] {CVE-2025-40064} - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147261] {CVE-2026-23097} - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-134673] - autofs: use wake_up() instead of wake_up_interruptible(() (Ian Kent) [RHEL-143685] - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Ian Kent) [RHEL-143685] {CVE-2023-54134} - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141709] - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-136693] - audit: merge loops in __audit_inode_child() (Ricardo Robaina) [RHEL-140442] - bridge: mcast: Fix use-after-free during router port configuration (Mohammad Heib) [RHEL-138422] {CVE-2025-38248} - net/sched: Enforce that teql can only be used as root qdisc (CKI Backport Bot) [RHEL-146992] {CVE-2026-23074} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Marc Milgram) [RHEL-137838] {CVE-2025-38129} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143189] {CVE-2025-68800} - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126886] {CVE-2025-40064} - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - macvlan: fix possible UAF in macvlan_forward_source() (Hangbin Liu) [RHEL-144120] {CVE-2026-23001} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-131922] - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount (Jocelyn Falempe) [RHEL-148636] - audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd references (Waiman Long) [RHEL-146026] - fs: Add a pool of extra fs->pwd references to fs_struct (Waiman Long) [RHEL-146026] - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143535] {CVE-2025-71085} - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147261] {CVE-2026-23097} - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-134673] - autofs: use wake_up() instead of wake_up_interruptible(() (Ian Kent) [RHEL-143685] - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Ian Kent) [RHEL-143685] {CVE-2023-54134} - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141709] - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-136693] - audit: merge loops in __audit_inode_child() (Ricardo Robaina) [RHEL-140442] - bridge: mcast: Fix use-after-free during router port configuration (Mohammad Heib) [RHEL-138422] {CVE-2025-38248} - net/sched: Enforce that teql can only be used as root qdisc (CKI Backport Bot) [RHEL-146992] {CVE-2026-23074} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Marc Milgram) [RHEL-137838] {CVE-2025-38129} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143189] {CVE-2025-68800} - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126886] {CVE-2025-40064} - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - x86/microcode/AMD: Revert "Backport AMD microcode commits for better microcode loading support" (Waiman Long) [RHEL-155860] - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150398] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150398] - tcp: fix forever orphan socket caused by tcp_abort (Paolo Abeni) [RHEL-146187] - xfs: fix minimum agno handling for xfs alloc modes in RHEL8 (Brian Foster) [RHEL-102464] - xfs: fix uninitialized use of flags variable in xfs_alloc_vextent() (Brian Foster) [RHEL-102464] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82523] - tcp: use this_cpu_read(*X) instead of *this_cpu_ptr(X) (Davide Caratti) [RHEL-82523] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150221] - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150221] {CVE-2026-23209} - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) [RHEL-96016] - s390/kexec: Emit an error message when cmdline is too long (Mete Durlu) [RHEL-144946] - s390/boot: Fix kernel size in bootparm area (Mete Durlu) [RHEL-144946] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-137123] - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-151614] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove useless transaction in evict_linked_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-151614] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-151614] - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146419] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146419] {CVE-2025-38323} - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136288] - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136288] - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136288] - scsi: st: Tighten the page format heuristics with MODE SELECT (John Meneghini) [RHEL-136288] - scsi: st: ERASE does not change tape location (John Meneghini) [RHEL-136288] - scsi: st: Fix array overflow in st_setup() (John Meneghini) [RHEL-136288] - scsi: st: Add sysfs file position_lost_in_reset (John Meneghini) [RHEL-136288] - scsi: st: Modify st.c to use the new scsi_error counters (John Meneghini) [RHEL-136288] - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (John Meneghini) [RHEL-136288] - scsi: st: Restore some drive settings after reset (John Meneghini) [RHEL-136288] - scsi: st: Fix input/output error on empty drive reset (John Meneghini) [RHEL-136288] - smb: client: handle lack of IPC in dfs_cache_refresh() (Paulo Alcantara) [RHEL-138235] - smb: client: allow parsing zero-length AV pairs (Paulo Alcantara) [RHEL-138235] - cifs: reduce warning log level for server not advertising interfaces (Paulo Alcantara) [RHEL-138235] - smb: client: Fix match_session bug preventing session reuse (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of kstrdup() in get_ses_refpath() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy when tree connecting to DFS interlink targets (Paulo Alcantara) [RHEL-138235] - smb: client: don't trust DFSREF_STORAGE_SERVER bit (Paulo Alcantara) [RHEL-138235] - smb: client: don't check for @leaf_fullpath in match_server() (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of TCP_Server_Info::refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: don't retry DFS targets on server shutdown (Paulo Alcantara) [RHEL-138235] - smb: client: fix return value of parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: optimize referral walk on failed link targets (Paulo Alcantara) [RHEL-138235] - smb: client: provide dns_resolve_{unc,name} helpers (Paulo Alcantara) [RHEL-138235] - smb: client: parse DNS domain name from domain= option (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS mount against old servers with NTLMSSP (Paulo Alcantara) [RHEL-138235] - smb: client: parse av pair type 4 in CHALLENGE_MESSAGE (Paulo Alcantara) [RHEL-138235] - smb: client: introduce av_for_each_entry() helper (Paulo Alcantara) [RHEL-138235] - smb: client: fix double free of TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-138235] {CVE-2025-21673} - smb: client: fix potential race in cifs_put_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy message when mounting shares (Paulo Alcantara) [RHEL-138235] - smb: client: don't try following DFS links in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow reconnect when sending ioctl (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of @nlsc param in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow more DFS referrals to be cached (Paulo Alcantara) [RHEL-138235] - smb: client: propagate error from cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS failover in multiuser mounts (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS interlink failover (Paulo Alcantara) [RHEL-138235] - smb: client: improve purging of cached referrals (Paulo Alcantara) [RHEL-138235] - smb: client: avoid unnecessary reconnects when refreshing referrals (Paulo Alcantara) [RHEL-138235] - smb: client: serialise cifs_construct_tcon() with cifs_mount_mutex (Paulo Alcantara) [RHEL-138235] - smb: client: handle DFS tcons in cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: refresh referral without acquiring refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: guarantee refcounted children from parent session (Paulo Alcantara) [RHEL-138235] {CVE-2024-35869} - smb: client: set correct id, uid and cruid for multiuser automounts (Paulo Alcantara) [RHEL-138235] {CVE-2024-26822} - cifs: change tcon status when need_reconnect is set on it (Paulo Alcantara) [RHEL-138235] - smb: client: fix potential NULL deref in parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: fix mount when dns_resolver key is not available (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs code dep in namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs naming in automount code (Paulo Alcantara) [RHEL-138235] - smb: client: rename cifs_dfs_ref.c to namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: ensure to try all targets when finding nested links (Paulo Alcantara) [RHEL-138235] - smb: client: introduce DFS_CACHE_TGT_LIST() (Paulo Alcantara) [RHEL-138235] - smb: client: fix null auth (Paulo Alcantara) [RHEL-138235] - smb: client: fix dfs link mount against w2k8 (Paulo Alcantara) [RHEL-138235] - cifs: fix charset issue in reconnection (Paulo Alcantara) [RHEL-138235] - smb: client: fix missed ses refcounting (Paulo Alcantara) [RHEL-138235] {CVE-2023-54076} - fs/nls: make load_nls() take a const parameter (Paulo Alcantara) [RHEL-138235] - smb: client: remove redundant pointer 'server' (Paulo Alcantara) [RHEL-138235] - smb: client: improve DFS mount check (Paulo Alcantara) [RHEL-138235] - smb: client: fix shared DFS root mounts with different prefixes (Paulo Alcantara) [RHEL-138235] - smb: client: fix parsing of source mount option (Paulo Alcantara) [RHEL-138235] - smb: client: fix warning in cifs_match_super() (Paulo Alcantara) [RHEL-138235] - cifs: fix max_credits implementation (Paulo Alcantara) [RHEL-138235] - cifs: fix sockaddr comparison in iface_cmp (Paulo Alcantara) [RHEL-138235] - cifs: fix status checks in cifs_tree_connect (Paulo Alcantara) [RHEL-138235] - cifs: fix smb1 mount regression (Paulo Alcantara) [RHEL-138235] - cifs: fix sharing of DFS connections (Paulo Alcantara) [RHEL-138235] - cifs: avoid potential races when handling multiple dfs tcons (Paulo Alcantara) [RHEL-138235] - cifs: protect access of TCP_Server_Info::{origin,leaf}_fullpath (Paulo Alcantara) [RHEL-138235] - cifs: avoid dup prefix path in dfs_get_automount_devname() (Paulo Alcantara) [RHEL-138235] - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL (Paulo Alcantara) [RHEL-138235] {CVE-2023-53246} - smb3: fix unusable share after force unmount failure (Paulo Alcantara) [RHEL-138235] - cifs: check only tcon status on tcon related functions (Paulo Alcantara) [RHEL-138235] - cifs: return DFS root session id in DebugData (Paulo Alcantara) [RHEL-138235] - cifs: fix use-after-free bug in refresh_cache_worker() (Paulo Alcantara) [RHEL-138235] {CVE-2023-53052} - cifs: set DFS root session in cifs_get_smb_ses() (Paulo Alcantara) [RHEL-138235] - cifs: remove unused function (Paulo Alcantara) [RHEL-138235] - cifs: remove duplicate code in __refresh_tcon() (Paulo Alcantara) [RHEL-138235] - cifs: remove redundant assignment to the variable match (Paulo Alcantara) [RHEL-138235] - cifs: use origin fullpath for automounts (Paulo Alcantara) [RHEL-138235] - cifs: fix source pathname comparison of dfs supers (Paulo Alcantara) [RHEL-138235] - cifs: fix confusing debug message (Paulo Alcantara) [RHEL-138235] - cifs: don't block in dfs_cache_noreq_update_tgthint() (Paulo Alcantara) [RHEL-138235] - cifs: refresh root referrals (Paulo Alcantara) [RHEL-138235] - cifs: fix refresh of cached referrals (Paulo Alcantara) [RHEL-138235] - cifs: share dfs connections and supers (Paulo Alcantara) [RHEL-138235] - cifs: split out ses and tcon retrieval from mount_get_conns() (Paulo Alcantara) [RHEL-138235] - cifs: set resolved ip in sockaddr (Paulo Alcantara) [RHEL-138235] - cifs: remove unused smb3_fs_context::mount_options (Paulo Alcantara) [RHEL-138235] - cifs: get rid of mount options string parsing (Paulo Alcantara) [RHEL-138235] - cifs: use fs_context for automounts (Paulo Alcantara) [RHEL-138235] - cifs: remove various function description warnings (Paulo Alcantara) [RHEL-138235] - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Select which microcode patch to load (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add more known models to entry sign checking (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Limit Entrysign signature checking to known generations (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use sha256() instead of init/update/final (Waiman Long) [RHEL-132479] - x86/microcode: Fix Entrysign revision check for Zen1/Naples (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Handle the case of no BIOS microcode (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add some forgotten models to the SHA check (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Load only SHA256-checksummed patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add get_patch_level() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Merge early_apply_microcode() into its single callsite (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Have __apply_microcode_amd() return bool (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Flush patch buffer mapping after application (Waiman Long) [RHEL-132479] - x86/mm: Carve out INVLPG inline asm for use by others (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Split load_microcode_amd() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Pay attention to the stepping dynamically (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix a -Wsometimes-uninitialized clang false positive (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use the family,model,stepping encoded in the patch ID (Waiman Long) [RHEL-132479] - x86/microcode/amd: Cache builtin microcode too (Waiman Long) [RHEL-132479] - x86/microcode/amd: Use correct per CPU ucode_cpu_info (Waiman Long) [RHEL-132479] - x86/microcode/amd: Remove X86_32 specific code in early_apply_microcode() & get_builtin_microcode() (Waiman Long) [RHEL-132479] - x86/microcode: Move core specific defines to local header (Waiman Long) [RHEL-132479] - x86/microcode/intel: Rename get_datasize() since its used externally (Waiman Long) [RHEL-132479] - x86/microcode: Make reload_early_microcode() static (Waiman Long) [RHEL-132479] - x86/microcode: Include vendor headers into microcode.h (Waiman Long) [RHEL-132479] - x86/microcode/intel: Move microcode functions out of cpu/intel.c (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Get rid of __find_equiv_id() (Waiman Long) [RHEL-132479] - x86/microcode: Add explicit CPU vendor dependency (Waiman Long) [RHEL-132479] - macvlan: fix possible UAF in macvlan_forward_source() (Hangbin Liu) [RHEL-144120] {CVE-2026-23001} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-131922] - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount (Jocelyn Falempe) [RHEL-148636] - audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd references (Waiman Long) [RHEL-146026] - fs: Add a pool of extra fs->pwd references to fs_struct (Waiman Long) [RHEL-146026] - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143535] {CVE-2025-71085} - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147261] {CVE-2026-23097} - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-134673] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930] - NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242] - pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242] - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242] - NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242] - NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242] - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242] - SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242] - NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242] - SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242] - SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242] - SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242] - SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242] - NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242] - NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419] - nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419] - pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419] - NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419] - NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419] - NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419] - NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419] - NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419] - NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419] - NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419] - NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419] - NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419] - nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419] - nfs: always check dreq->error after a commit (Mike Snitzer) [RHEL-156419] - nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419] - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231} - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942] - x86/microcode/AMD: Revert "Backport AMD microcode commits for better microcode loading support" (Waiman Long) [RHEL-155860] - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150398] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150398] - tcp: fix forever orphan socket caused by tcp_abort (Paolo Abeni) [RHEL-146187] - xfs: fix minimum agno handling for xfs alloc modes in RHEL8 (Brian Foster) [RHEL-102464] - xfs: fix uninitialized use of flags variable in xfs_alloc_vextent() (Brian Foster) [RHEL-102464] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82523] - tcp: use this_cpu_read(*X) instead of *this_cpu_ptr(X) (Davide Caratti) [RHEL-82523] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150221] - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150221] {CVE-2026-23209} - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) [RHEL-96016] - s390/kexec: Emit an error message when cmdline is too long (Mete Durlu) [RHEL-144946] - s390/boot: Fix kernel size in bootparm area (Mete Durlu) [RHEL-144946] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-137123] - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-151614] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove useless transaction in evict_linked_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-151614] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-151614] - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146419] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146419] {CVE-2025-38323} - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136288] - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136288] - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136288] - scsi: st: Tighten the page format heuristics with MODE SELECT (John Meneghini) [RHEL-136288] - scsi: st: ERASE does not change tape location (John Meneghini) [RHEL-136288] - scsi: st: Fix array overflow in st_setup() (John Meneghini) [RHEL-136288] - scsi: st: Add sysfs file position_lost_in_reset (John Meneghini) [RHEL-136288] - scsi: st: Modify st.c to use the new scsi_error counters (John Meneghini) [RHEL-136288] - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (John Meneghini) [RHEL-136288] - scsi: st: Restore some drive settings after reset (John Meneghini) [RHEL-136288] - scsi: st: Fix input/output error on empty drive reset (John Meneghini) [RHEL-136288] - smb: client: handle lack of IPC in dfs_cache_refresh() (Paulo Alcantara) [RHEL-138235] - smb: client: allow parsing zero-length AV pairs (Paulo Alcantara) [RHEL-138235] - cifs: reduce warning log level for server not advertising interfaces (Paulo Alcantara) [RHEL-138235] - smb: client: Fix match_session bug preventing session reuse (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of kstrdup() in get_ses_refpath() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy when tree connecting to DFS interlink targets (Paulo Alcantara) [RHEL-138235] - smb: client: don't trust DFSREF_STORAGE_SERVER bit (Paulo Alcantara) [RHEL-138235] - smb: client: don't check for @leaf_fullpath in match_server() (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of TCP_Server_Info::refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: don't retry DFS targets on server shutdown (Paulo Alcantara) [RHEL-138235] - smb: client: fix return value of parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: optimize referral walk on failed link targets (Paulo Alcantara) [RHEL-138235] - smb: client: provide dns_resolve_{unc,name} helpers (Paulo Alcantara) [RHEL-138235] - smb: client: parse DNS domain name from domain= option (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS mount against old servers with NTLMSSP (Paulo Alcantara) [RHEL-138235] - smb: client: parse av pair type 4 in CHALLENGE_MESSAGE (Paulo Alcantara) [RHEL-138235] - smb: client: introduce av_for_each_entry() helper (Paulo Alcantara) [RHEL-138235] - smb: client: fix double free of TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-138235] {CVE-2025-21673} - smb: client: fix potential race in cifs_put_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy message when mounting shares (Paulo Alcantara) [RHEL-138235] - smb: client: don't try following DFS links in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow reconnect when sending ioctl (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of @nlsc param in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow more DFS referrals to be cached (Paulo Alcantara) [RHEL-138235] - smb: client: propagate error from cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS failover in multiuser mounts (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS interlink failover (Paulo Alcantara) [RHEL-138235] - smb: client: improve purging of cached referrals (Paulo Alcantara) [RHEL-138235] - smb: client: avoid unnecessary reconnects when refreshing referrals (Paulo Alcantara) [RHEL-138235] - smb: client: serialise cifs_construct_tcon() with cifs_mount_mutex (Paulo Alcantara) [RHEL-138235] - smb: client: handle DFS tcons in cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: refresh referral without acquiring refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: guarantee refcounted children from parent session (Paulo Alcantara) [RHEL-138235] {CVE-2024-35869} - smb: client: set correct id, uid and cruid for multiuser automounts (Paulo Alcantara) [RHEL-138235] {CVE-2024-26822} - cifs: change tcon status when need_reconnect is set on it (Paulo Alcantara) [RHEL-138235] - smb: client: fix potential NULL deref in parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: fix mount when dns_resolver key is not available (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs code dep in namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs naming in automount code (Paulo Alcantara) [RHEL-138235] - smb: client: rename cifs_dfs_ref.c to namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: ensure to try all targets when finding nested links (Paulo Alcantara) [RHEL-138235] - smb: client: introduce DFS_CACHE_TGT_LIST() (Paulo Alcantara) [RHEL-138235] - smb: client: fix null auth (Paulo Alcantara) [RHEL-138235] - smb: client: fix dfs link mount against w2k8 (Paulo Alcantara) [RHEL-138235] - cifs: fix charset issue in reconnection (Paulo Alcantara) [RHEL-138235] - smb: client: fix missed ses refcounting (Paulo Alcantara) [RHEL-138235] {CVE-2023-54076} - fs/nls: make load_nls() take a const parameter (Paulo Alcantara) [RHEL-138235] - smb: client: remove redundant pointer 'server' (Paulo Alcantara) [RHEL-138235] - smb: client: improve DFS mount check (Paulo Alcantara) [RHEL-138235] - smb: client: fix shared DFS root mounts with different prefixes (Paulo Alcantara) [RHEL-138235] - smb: client: fix parsing of source mount option (Paulo Alcantara) [RHEL-138235] - smb: client: fix warning in cifs_match_super() (Paulo Alcantara) [RHEL-138235] - cifs: fix max_credits implementation (Paulo Alcantara) [RHEL-138235] - cifs: fix sockaddr comparison in iface_cmp (Paulo Alcantara) [RHEL-138235] - cifs: fix status checks in cifs_tree_connect (Paulo Alcantara) [RHEL-138235] - cifs: fix smb1 mount regression (Paulo Alcantara) [RHEL-138235] - cifs: fix sharing of DFS connections (Paulo Alcantara) [RHEL-138235] - cifs: avoid potential races when handling multiple dfs tcons (Paulo Alcantara) [RHEL-138235] - cifs: protect access of TCP_Server_Info::{origin,leaf}_fullpath (Paulo Alcantara) [RHEL-138235] - cifs: avoid dup prefix path in dfs_get_automount_devname() (Paulo Alcantara) [RHEL-138235] - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL (Paulo Alcantara) [RHEL-138235] {CVE-2023-53246} - smb3: fix unusable share after force unmount failure (Paulo Alcantara) [RHEL-138235] - cifs: check only tcon status on tcon related functions (Paulo Alcantara) [RHEL-138235] - cifs: return DFS root session id in DebugData (Paulo Alcantara) [RHEL-138235] - cifs: fix use-after-free bug in refresh_cache_worker() (Paulo Alcantara) [RHEL-138235] {CVE-2023-53052} - cifs: set DFS root session in cifs_get_smb_ses() (Paulo Alcantara) [RHEL-138235] - cifs: remove unused function (Paulo Alcantara) [RHEL-138235] - cifs: remove duplicate code in __refresh_tcon() (Paulo Alcantara) [RHEL-138235] - cifs: remove redundant assignment to the variable match (Paulo Alcantara) [RHEL-138235] - cifs: use origin fullpath for automounts (Paulo Alcantara) [RHEL-138235] - cifs: fix source pathname comparison of dfs supers (Paulo Alcantara) [RHEL-138235] - cifs: fix confusing debug message (Paulo Alcantara) [RHEL-138235] - cifs: don't block in dfs_cache_noreq_update_tgthint() (Paulo Alcantara) [RHEL-138235] - cifs: refresh root referrals (Paulo Alcantara) [RHEL-138235] - cifs: fix refresh of cached referrals (Paulo Alcantara) [RHEL-138235] - cifs: share dfs connections and supers (Paulo Alcantara) [RHEL-138235] - cifs: split out ses and tcon retrieval from mount_get_conns() (Paulo Alcantara) [RHEL-138235] - cifs: set resolved ip in sockaddr (Paulo Alcantara) [RHEL-138235] - cifs: remove unused smb3_fs_context::mount_options (Paulo Alcantara) [RHEL-138235] - cifs: get rid of mount options string parsing (Paulo Alcantara) [RHEL-138235] - cifs: use fs_context for automounts (Paulo Alcantara) [RHEL-138235] - cifs: remove various function description warnings (Paulo Alcantara) [RHEL-138235] - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Select which microcode patch to load (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add more known models to entry sign checking (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Limit Entrysign signature checking to known generations (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use sha256() instead of init/update/final (Waiman Long) [RHEL-132479] - x86/microcode: Fix Entrysign revision check for Zen1/Naples (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Handle the case of no BIOS microcode (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add some forgotten models to the SHA check (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Load only SHA256-checksummed patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add get_patch_level() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Merge early_apply_microcode() into its single callsite (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Have __apply_microcode_amd() return bool (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Flush patch buffer mapping after application (Waiman Long) [RHEL-132479] - x86/mm: Carve out INVLPG inline asm for use by others (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Split load_microcode_amd() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Pay attention to the stepping dynamically (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix a -Wsometimes-uninitialized clang false positive (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use the family,model,stepping encoded in the patch ID (Waiman Long) [RHEL-132479] - x86/microcode/amd: Cache builtin microcode too (Waiman Long) [RHEL-132479] - x86/microcode/amd: Use correct per CPU ucode_cpu_info (Waiman Long) [RHEL-132479] - x86/microcode/amd: Remove X86_32 specific code in early_apply_microcode() & get_builtin_microcode() (Waiman Long) [RHEL-132479] - x86/microcode: Move core specific defines to local header (Waiman Long) [RHEL-132479] - x86/microcode/intel: Rename get_datasize() since its used externally (Waiman Long) [RHEL-132479] - x86/microcode: Make reload_early_microcode() static (Waiman Long) [RHEL-132479] - x86/microcode: Include vendor headers into microcode.h (Waiman Long) [RHEL-132479] - x86/microcode/intel: Move microcode functions out of cpu/intel.c (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Get rid of __find_equiv_id() (Waiman Long) [RHEL-132479] - x86/microcode: Add explicit CPU vendor dependency (Waiman Long) [RHEL-132479] - macvlan: fix possible UAF in macvlan_forward_source() (Hangbin Liu) [RHEL-144120] {CVE-2026-23001} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-131922] - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount (Jocelyn Falempe) [RHEL-148636] - audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd references (Waiman Long) [RHEL-146026] - fs: Add a pool of extra fs->pwd references to fs_struct (Waiman Long) [RHEL-146026] - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143535] {CVE-2025-71085} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930] - NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242] - pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242] - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242] - NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242] - NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242] - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242] - SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242] - NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242] - SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242] - SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242] - SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242] - SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242] - NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242] - NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419] - nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419] - pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419] - NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419] - NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419] - NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419] - NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419] - NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419] - NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419] - NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419] - NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419] - NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419] - nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419] - nfs: always check dreq->error after a commit (Mike Snitzer) [RHEL-156419] - nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419] - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231} - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942] - x86/microcode/AMD: Revert "Backport AMD microcode commits for better microcode loading support" (Waiman Long) [RHEL-155860] - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150398] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150398] - tcp: fix forever orphan socket caused by tcp_abort (Paolo Abeni) [RHEL-146187] - xfs: fix minimum agno handling for xfs alloc modes in RHEL8 (Brian Foster) [RHEL-102464] - xfs: fix uninitialized use of flags variable in xfs_alloc_vextent() (Brian Foster) [RHEL-102464] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82523] - tcp: use this_cpu_read(*X) instead of *this_cpu_ptr(X) (Davide Caratti) [RHEL-82523] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150221] - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150221] {CVE-2026-23209} - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) [RHEL-96016] - s390/kexec: Emit an error message when cmdline is too long (Mete Durlu) [RHEL-144946] - s390/boot: Fix kernel size in bootparm area (Mete Durlu) [RHEL-144946] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-137123] - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-151614] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove useless transaction in evict_linked_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-151614] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-151614] - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146419] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146419] {CVE-2025-38323} - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136288] - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136288] - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136288] - scsi: st: Tighten the page format heuristics with MODE SELECT (John Meneghini) [RHEL-136288] - scsi: st: ERASE does not change tape location (John Meneghini) [RHEL-136288] - scsi: st: Fix array overflow in st_setup() (John Meneghini) [RHEL-136288] - scsi: st: Add sysfs file position_lost_in_reset (John Meneghini) [RHEL-136288] - scsi: st: Modify st.c to use the new scsi_error counters (John Meneghini) [RHEL-136288] - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (John Meneghini) [RHEL-136288] - scsi: st: Restore some drive settings after reset (John Meneghini) [RHEL-136288] - scsi: st: Fix input/output error on empty drive reset (John Meneghini) [RHEL-136288] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930] - NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242] - pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242] - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242] - NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242] - NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242] - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242] - SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242] - NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242] - SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242] - SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242] - SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242] - SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242] - NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242] - NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419] - nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419] - pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419] - NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419] - NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419] - NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419] - NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419] - NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419] - NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419] - NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419] - NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419] - NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419] - nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419] - nfs: always check dreq->error after a commit (Mike Snitzer) [RHEL-156419] - nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419] - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231} - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942] - xfrm: esp: avoid in-place decrypt on shared skb frags - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772] - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772] - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772] - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772] - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772] - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772] - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709} - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815] - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815] - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815] - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190} - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408} - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684} - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032] - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032] - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032] - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032] - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032] - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032] - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032] - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032] - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032] - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183} - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219] - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219] - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219] - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219] - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219] - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219] - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219] - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347} - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243} - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890] - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890] - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890] - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890] - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890] - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890] - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890] - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613} - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961] - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858} - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392} - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781} - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990} - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772] - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772] - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772] - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772] - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772] - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772] - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709} - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815] - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815] - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815] - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190} - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408} - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684} - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032] - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032] - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032] - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032] - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032] - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032] - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032] - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032] - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032] - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183} - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219] - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219] - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219] - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219] - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219] - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219] - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219] - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347} - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243} - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890] - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890] - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890] - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890] - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890] - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890] - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890] - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613} - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961] - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858} - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392} - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781} - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990} - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772] - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772] - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772] - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772] - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772] - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772] - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709} - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815] - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815] - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815] - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190} - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408} - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684} - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032] - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032] - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032] - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032] - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032] - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032] - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032] - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032] - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032] - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183} - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219] - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219] - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219] - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219] - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219] - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219] - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219] - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347} - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243} - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890] - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890] - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890] - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890] - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890] - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890] - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890] - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613} - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961] - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858} - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392} - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781} - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - [rt] build kernel-rt-4.18.0-553.16.1.rt7.357.el8_10 [RHEL-44553] - x86/bhi: Fix incorrect CLEAR_BRANCH_HISTORY position in entry_INT80_compat (Waiman Long) [RHEL-50648] - [rt] build kernel-rt-4.18.0-553.15.1.rt7.356.el8_10 [RHEL-44553] - Revert "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-44613] - ionic: fix use after netif_napi_del() (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - ionic: clean interrupt before enabling queue to avoid credit race (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change (CKI Backport Bot) [RHEL-49321] {CVE-2021-47624} - xhci: Handle TD clearing for multiple streams case (CKI Backport Bot) [RHEL-47882] {CVE-2024-40927} - net: openvswitch: Fix Use-After-Free in ovs_ct_exit (cki-backport-bot) [RHEL-36362] {CVE-2024-27395} - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: fix vlan use-after-free (cki-backport-bot) [RHEL-43721] {CVE-2024-36979} - irqchip/gic-v3-its: Prevent double free on error (Charles Mirabile) [RHEL-37022] {CVE-2024-35847} - irqchip/gic-v3-its: Fix potential VPE leak on error (Charles Mirabile) [RHEL-37744] {CVE-2021-47373} - i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() (Charles Mirabile) [RHEL-34735] {CVE-2022-48632} - iommu/dma: fix zeroing of bounce buffer padding used by untrusted devices (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: remove alloc_size argument to swiotlb_tbl_map_single() (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: fix swiotlb_bounce() to do partial sync's correctly (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Reinstate page-alignment for mappings >= PAGE_SIZE (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix alignment checks when both allocation and DMA masks are present (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix double-allocation of slots due to broken alignment handling (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (cki-backport-bot) [RHEL-44441] {CVE-2024-31076} - [rt] build kernel-rt-4.18.0-553.14.1.rt7.355.el8_10 [RHEL-44553] - s390/qeth: Fix kernel panic after setting hsuid (Mete Durlu) [RHEL-49754] - perf/core: Protect event sibling list locking against interrupt inversion (Daniel Vacek) [RHEL-31798] - vt: fix unicode buffer corruption when deleting characters (Steve Best) [RHEL-36936] {CVE-2024-35823} - cifs: translate network errors on send to -ECONNABORTED (Paulo Alcantara) [RHEL-36754] - xfs: don't block in busy flushing when freeing extents (Brian Foster) [RHEL-7984] - xfs: allow extent free intents to be retried (Brian Foster) [RHEL-7984] - xfs: pass alloc flags through to xfs_extent_busy_flush() (Brian Foster) [RHEL-7984] - xfs: use deferred frees for btree block freeing (Brian Foster) [RHEL-7984] - xfs: fix bounds check in xfs_defer_agfl_block() (Brian Foster) [RHEL-7984] - xfs: validate block number being freed before adding to xefi (Brian Foster) [RHEL-7984] - xfs: rename xfs_bmap_add_free to xfs_free_extent_later (Brian Foster) [RHEL-7984] - usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (Desnes Nunes) [RHEL-36803] {CVE-2024-35790} - stm class: Fix a double free in stm_register_device() (Steve Best) [RHEL-44514] {CVE-2024-38627} - s390/qeth: Fix potential loss of L3-IP@ in case of network issues (Mete Durlu) [RHEL-49755] - tls: fix missing memory barrier in tls_init (cki-backport-bot) [RHEL-44471] {CVE-2024-36489} - xfs: fix log recovery buffer allocation for the legacy h_size fixup (Bill O'Donnell) [RHEL-46473] {CVE-2024-39472} - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: use __for_each_thread() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - exit: Use the correct exit_code in /proc/<pid>/stat (Brian Foster) [RHEL-31562] {CVE-2024-26686} - scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool (Ewan D. Milne) [RHEL-38283] {CVE-2023-52811} - scsi: qla2xxx: Fix double free of fcport (Ewan D. Milne) [RHEL-39549] {CVE-2024-26929} - scsi: qla2xxx: Fix double free of the ha->vp_map pointer (Ewan D. Milne) [RHEL-39549] {CVE-2024-26930} - scsi: qla2xxx: Fix command flush on cable pull (Ewan D. Milne) [RHEL-39549] {CVE-2024-26931} - [rt] build kernel-rt-4.18.0-553.13.1.rt7.354.el8_10 [RHEL-44553] - redhat: remove handling of deleted rhdocs/ directory from genspec.sh (Denys Vlasenko) - x86/bugs: Fix BHI retpoline check (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI handling of RRSBA (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr' (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI documentation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix return type of spectre_bhi_state() (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Make CONFIG_SPECTRE_BHI_ON the default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Mitigate KVM by default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add BHI mitigation knob (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Enumerate Branch History Injection (BHI) bug (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Define SPEC_CTRL_BHI_DIS_S (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add support for clearing branch history at syscall entry (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file (Waiman Long) [RHEL-28202] - perf/x86/amd/lbr: Use freeze based on availability (Waiman Long) [RHEL-28202] - Documentation/kernel-parameters: Add spec_rstack_overflow to mitigations=off (Waiman Long) [RHEL-28202] - KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace (Waiman Long) [RHEL-28202] - x86/bugs: Reset speculation control settings on init (Waiman Long) [RHEL-28202] - KVM: x86: Update KVM-only leaf handling to allow for 100% KVM-only leafs (Waiman Long) [RHEL-28202] - KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest (Waiman Long) [RHEL-28202] - mptcp: ensure snd_nxt is properly initialized on connect (Davide Caratti) [RHEL-39865] {CVE-2024-36889} - powerpc/pseries: Enforce hcall result buffer validity and size (Mamatha Inamdar) [RHEL-48291] {CVE-2024-40974} - wifi: mac80211: fix potential key use-after-free (Jose Ignacio Tornos Martinez) [RHEL-28007] {CVE-2023-52530} - cppc_cpufreq: Fix possible null pointer dereference (Mark Langsdorf) [RHEL-44137] {CVE-2024-38573} - net/sched: act_mirred: use the backlog for mirred ingress (Davide Caratti) [RHEL-31718] {CVE-2024-26740} - vfio/pci: Lock external INTx masking ops (Alex Williamson) [RHEL-31922] {CVE-2024-26810} - net: sched: sch_multiq: fix possible OOB write in multiq_tune() (Davide Caratti) [RHEL-43464] {CVE-2024-36978} - tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized (Guillaume Nault) [RHEL-37850] {CVE-2021-47304} - pstore/ram: Fix crash when setting number of cpus to an odd number (Lenny Szubowicz) [RHEL-29471] {CVE-2023-52619} - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node (Jocelyn Falempe) [RHEL-37101] {CVE-2023-52662} - drm/vmwgfx: Fix the lifetime of the bo cursor memory (Jocelyn Falempe) [RHEL-36962] {CVE-2024-35810} - drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed (Jocelyn Falempe) [RHEL-34987] {CVE-2024-26940} - drm/vmwgfx: Unmap the surface before resetting it on a plane state (Jocelyn Falempe) [RHEL-35217] {CVE-2023-52648} - drm/vmwgfx: Fix invalid reads in fence signaled events (Jocelyn Falempe) [RHEL-40010] {CVE-2024-36960} - block: Fix wrong offset in bio_truncate() (Ming Lei) [RHEL-43782] {CVE-2022-48747} - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CKI Backport Bot) [RHEL-46913] {CVE-2024-39487} - net: fix __dst_negative_advice() race (Xin Long) [RHEL-41183] {CVE-2024-36971} - igc: avoid returning frame twice in XDP_REDIRECT (Corinna Vinschen) [RHEL-33264] {CVE-2024-26853} - mac802154: fix llsec key resources release in mac802154_llsec_key_del (Steve Best) [RHEL-34967] {CVE-2024-26961} - cpufreq: exit() callback is optional (Mark Langsdorf) [RHEL-43840] {CVE-2024-38615} - cifs: prevent infinite recursion in CIFSGetDFSRefer() (Paulo Alcantara) [RHEL-34672] - cifs: lock chan_lock outside match_session (Paulo Alcantara) [RHEL-34672] - smb3: workaround negprot bug in some Samba servers (Paulo Alcantara) [RHEL-34672] - smb3: use netname when available on secondary channels (Paulo Alcantara) [RHEL-34672] - smb3: fix empty netname context on secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: populate empty hostnames for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: always iterate smb sessions using primary channel (Paulo Alcantara) [RHEL-34672] - cifs: Fix connections leak when tlink setup failed (Paulo Alcantara) [RHEL-34672] - cifs: Fix memory leak when build ntlmssp negotiate blob failed (Paulo Alcantara) [RHEL-34672] - cifs: always initialize struct msghdr smb_msg completely (Paulo Alcantara) [RHEL-34672] - cifs: don't send down the destination address to sendmsg for a SOCK_STREAM (Paulo Alcantara) [RHEL-34672] - cifs: revalidate mapping when doing direct writes (Paulo Alcantara) [RHEL-34672] - cifs: skip extra NULL byte in filenames (Paulo Alcantara) [RHEL-34672] - cifs: list_for_each() -> list_for_each_entry() (Paulo Alcantara) [RHEL-34672] - smb2: small refactor in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - cifs: Fix crash on unload of cifs_arc4.ko (Paulo Alcantara) [RHEL-34672] - cifs: remove check of list iterator against head past the loop body (Paulo Alcantara) [RHEL-34672] - cifs: fix reconnect on smb3 mount types (Paulo Alcantara) [RHEL-34672] - cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (Paulo Alcantara) [RHEL-34672] - cifs: skip trailing separators of prefix paths (Paulo Alcantara) [RHEL-34672] - cifs: fix ntlmssp on old servers (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL ptr dereference in refresh_mounts() (Paulo Alcantara) [RHEL-34672] - cifs: do not skip link targets when an I/O fails (Paulo Alcantara) [RHEL-34672] - cifs: fix confusing unneeded warning message on smb2.1 and earlier (Paulo Alcantara) [RHEL-34672] - smb3: fix snapshot mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix workstation_name for multiuser mounts (Paulo Alcantara) [RHEL-34672] - cifs: alloc_path_with_tree_prefix: do not append sep. if the path is empty (Paulo Alcantara) [RHEL-34672] - cifs: free ntlmsspblob allocated in negotiate (Paulo Alcantara) [RHEL-34672] - cifs: avoid use of dstaddr as key for fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: add server conn_id to fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: fix missed refcounting of ipc tcon (Paulo Alcantara) [RHEL-34672] - smb2: clarify rc initialization in smb2_reconnect (Paulo Alcantara) [RHEL-34672] - cifs: populate server_hostname for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should be set on new server (Paulo Alcantara) [RHEL-34672] - cifs: introduce cifs_ses_mark_for_reconnect() helper (Paulo Alcantara) [RHEL-34672] - cifs: protect srv_count with cifs_tcp_ses_lock (Paulo Alcantara) [RHEL-34672] - cifs: move debug print out of spinlock (Paulo Alcantara) [RHEL-34672] - cifs: do not duplicate fscache cookie for secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: connect individual channel servers to primary channel server (Paulo Alcantara) [RHEL-34672] - cifs: protect session channel fields with chan_lock (Paulo Alcantara) [RHEL-34672] - cifs: do not negotiate session if session already exists (Paulo Alcantara) [RHEL-34672] - smb3: do not setup the fscache_super_cookie until fsinfo initialized (Paulo Alcantara) [RHEL-34672] - cifs: fix potential use-after-free bugs (Paulo Alcantara) [RHEL-34672] - cifs: release lock earlier in dequeue_mid error case (Paulo Alcantara) [RHEL-34672] - smb3: remove trivial dfs compile warning (Paulo Alcantara) [RHEL-34672] - cifs: support nested dfs links over reconnect (Paulo Alcantara) [RHEL-34672] - cifs: for compound requests, use open handle if possible (Paulo Alcantara) [RHEL-34672] - cifs: split out dfs code from cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant (Paulo Alcantara) [RHEL-34672] - cifs: introduce new helper for cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: fix print of hdr_flags in dfscache_proc_show() (Paulo Alcantara) [RHEL-34672] - cifs: send workstation name during ntlmssp session setup (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should not share socket with future sessions (Paulo Alcantara) [RHEL-34672] - smb3: add dynamic trace points for socket connection (Paulo Alcantara) [RHEL-34672] - cifs: Move SMB2_Create definitions to the shared area (Paulo Alcantara) [RHEL-34672] - cifs: Move more definitions into the shared area (Paulo Alcantara) [RHEL-34672] - cifs: move NEGOTIATE_PROTOCOL definitions out into the common area (Paulo Alcantara) [RHEL-34672] - cifs: Create a new shared file holding smb2 pdu definitions (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect check for null pointer in header_assemble (Paulo Alcantara) [RHEL-34672] - smb3: correct server pointer dereferencing check to be more consistent (Paulo Alcantara) [RHEL-34672] - cifs: Deal with some warnings from W=1 (Paulo Alcantara) [RHEL-34672] - cifs: fix a sign extension bug (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect kernel doc comments (Paulo Alcantara) [RHEL-34672] - cifs: remove pathname for file from SPDX header (Paulo Alcantara) [RHEL-34672] - cifs: move SMB FSCTL definitions to common code (Paulo Alcantara) [RHEL-34672] - cifs: rename cifs_common to smbfs_common (Paulo Alcantara) [RHEL-34672] - cifs: update FSCTL definitions (Paulo Alcantara) [RHEL-34672] - cifs: cifs_md4 convert to SPDX identifier (Paulo Alcantara) [RHEL-34672] - cifs: create a MD4 module and switch cifs.ko to use it (Paulo Alcantara) [RHEL-34672] - cifs: fork arc4 and create a separate module for it for cifs and other users (Paulo Alcantara) [RHEL-34672] - smb3: fix posix extensions mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix wrong release in sess_alloc_buffer() failed path (Paulo Alcantara) [RHEL-34672] - CIFS: Fix a potencially linear read overflow (Paulo Alcantara) [RHEL-34672] - cifs: use the correct max-length for dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: create sd context must be a multiple of 8 (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp sessions of dfs connections (Paulo Alcantara) [RHEL-34672] - cifs: added WARN_ON for all the count decrements (Paulo Alcantara) [RHEL-34672] - cifs: fix missing null session check in mount (Paulo Alcantara) [RHEL-34672] - cifs: handle reconnect of tcon when there is no cached dfs referral (Paulo Alcantara) [RHEL-34672] - cifs: fix the out of range assignment to bit fields in parse_server_interfaces (Paulo Alcantara) [RHEL-34672] - smb3: fix typo in header file (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: Add support for negotiating signing algorithm (Paulo Alcantara) [RHEL-34672] - cifs: prevent NULL deref in cifs_compose_mount_options() (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL dereference in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - smbdirect: missing rc checks while waiting for rdma events (Paulo Alcantara) [RHEL-34672] - cifs: Avoid field over-reading memcpy() (Paulo Alcantara) [RHEL-34672] - smb311: remove dead code for non compounded posix query info (Paulo Alcantara) [RHEL-34672] - cifs: fix SMB1 error path in cifs_get_file_info_unix (Paulo Alcantara) [RHEL-34672] - smb3: fix uninitialized value for port in witness protocol move (Paulo Alcantara) [RHEL-34672] - cifs: fix unneeded null check (Paulo Alcantara) [RHEL-34672] - cifs: use SPDX-Licence-Identifier (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in cifs_debug.c (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in smb2misc.c (Paulo Alcantara) [RHEL-34672] - cifs: missed ref-counting smb session in find (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp servers with dfs mounts (Paulo Alcantara) [RHEL-34672] - cifs: set a minimum of 2 minutes for refreshing dfs cache (Paulo Alcantara) [RHEL-34672] - cifs: Remove unused inline function is_sysvol_or_netlogon() (Paulo Alcantara) [RHEL-34672] - cifs: remove duplicated prototype (Paulo Alcantara) [RHEL-34672] - cifs: fix ipv6 formating in cifs_ses_add_channel (Paulo Alcantara) [RHEL-34672] - cifs: fix string declarations and assignments in tracepoints (Paulo Alcantara) [RHEL-34672] - cifs: fix memory leak in smb2_copychunk_range (Paulo Alcantara) [RHEL-34672] - SMB3: incorrect file id in requests compounded with open (Paulo Alcantara) [RHEL-34672] - smb3: if max_channels set to more than one channel request multichannel (Paulo Alcantara) [RHEL-34672] - smb3: do not attempt multichannel to server which does not support it (Paulo Alcantara) [RHEL-34672] - smb3: when mounting with multichannel include it in requested capabilities (Paulo Alcantara) [RHEL-34672] - cifs: simplify SWN code with dummy funcs instead of ifdefs (Paulo Alcantara) [RHEL-34672] - cifs: log mount errors using cifs_errorf() (Paulo Alcantara) [RHEL-34672] - cifs: switch build_path_from_dentry() to using dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: fix out-of-bound memory access when calling smb3_notify() at mount point (Paulo Alcantara) [RHEL-34672] - cifs: allocate buffer in the caller of build_path_from_dentry() (Paulo Alcantara) [RHEL-34672] - cifs: make build_path_from_dentry() return const char * (Paulo Alcantara) [RHEL-34672] - cifs: remove old dead code (Paulo Alcantara) [RHEL-34672] - fs: cifs: Remove repeated struct declaration (Paulo Alcantara) [RHEL-34672] - cifs: have cifs_fattr_to_inode() refuse to change type on live inode (Paulo Alcantara) [RHEL-34672] - cifs: have ->mkdir() handle race with another client sanely (Paulo Alcantara) [RHEL-34672] - do_cifs_create(): don't set ->i_mode of something we had not created (Paulo Alcantara) [RHEL-34672] - cifs: Silently ignore unknown oplock break handle (Paulo Alcantara) [RHEL-34672] - cifs: change noisy error message to FYI (Paulo Alcantara) [RHEL-34672] - cifs: print MIDs in decimal notation (Paulo Alcantara) [RHEL-34672] - cifs: minor simplification to smb2_is_network_name_deleted (Paulo Alcantara) [RHEL-34672] - TCON Reconnect during STATUS_NETWORK_NAME_DELETED (Paulo Alcantara) [RHEL-34672] - cifs: clarify hostname vs ip address in /proc/fs/cifs/DebugData (Paulo Alcantara) [RHEL-34672] - cifs: change confusing field serverName (to ip_addr) (Paulo Alcantara) [RHEL-34672] - cifs: Reformat DebugData and index connections by conn_id. (Paulo Alcantara) [RHEL-34672] - cifs: Identify a connection by a conn_id. (Paulo Alcantara) [RHEL-34672] - smb3: negotiate current dialect (SMB3.1.1) when version 3 or greater requested (Paulo Alcantara) [RHEL-34672] - smb3: Fix out-of-bounds bug in SMB2_negotiate() (Paulo Alcantara) [RHEL-34672] - fs/cifs: Simplify bool comparison. (Paulo Alcantara) [RHEL-34672] - fs/cifs: Assign boolean values to a bool variable (Paulo Alcantara) [RHEL-34672] - cifs: Avoid error pointer dereference (Paulo Alcantara) [RHEL-34672] - cifs: Re-indent cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Unlock on errors in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Delete a stray unlock in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Tracepoints and logs for tracing credit changes. (Paulo Alcantara) [RHEL-34672] - cifs: Fix some error pointers handling detected by static checker (Paulo Alcantara) [RHEL-34672] - smb3: remind users that witness protocol is experimental (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: do not log warning message if server doesn't populate salt (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: update comments clarifying SPNEGO info in negprot response (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot rsp (Paulo Alcantara) [RHEL-34672] - SMB3: avoid confusing warning message on mount to Azure (Paulo Alcantara) [RHEL-34672] - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (Nigel Croxon) [RHEL-46662] {CVE-2024-39476} - net: fix information leakage in /proc/net/ptype (Hangbin Liu) [RHEL-44000] {CVE-2022-48757} - usb: typec: ucsi: Limit read size on v1.2 (Desnes Nunes) [RHEL-37286] {CVE-2024-35924} - minmax: relax check to allow comparison between unsigned arguments and signed constants (Desnes Nunes) [RHEL-37286] - minmax: allow comparisons of 'int' against 'unsigned char/short' (Desnes Nunes) [RHEL-37286] - minmax: allow min()/max()/clamp() if the arguments have the same signedness. (Desnes Nunes) [RHEL-37286] - minmax: add umin(a, b) and umax(a, b) (Desnes Nunes) [RHEL-37286] - minmax: fix header inclusions (Desnes Nunes) [RHEL-37286] - minmax: clamp more efficiently by avoiding extra comparison (Desnes Nunes) [RHEL-37286] - minmax: sanity check constant bounds when clamping (Desnes Nunes) [RHEL-37286] - tracing: Define the is_signed_type() macro once (Desnes Nunes) [RHEL-37286] - linux/bits.h: fix compilation error with GENMASK (Desnes Nunes) [RHEL-37286] - x86/apic: Mask IOAPIC entries when disabling the local APIC (Lenny Szubowicz) [RHEL-18077] - userfaultfd: fix a race between writeprotect and exit_mmap() (Rafael Aquini) [RHEL-38410] {CVE-2021-47461} - mm: khugepaged: skip huge page collapse for special files (Waiman Long) [RHEL-38446] {CVE-2021-47491} - cachefiles: fix memory leak in cachefiles_add_cache() (Andrey Albershteyn) [RHEL-33109] {CVE-2024-26840} - drm/amd/display: Implement bounds check for stream encoder creation in DCN301 (Michel Dänzer) [RHEL-31429] {CVE-2024-26660} - net/mlx5: Discard command completions in internal error (Kamal Heib) [RHEL-44231] {CVE-2024-38555} - drm: Don't unref the same fb many times by mistake due to deadlock handling (CKI Backport Bot) [RHEL-29011] {CVE-2023-52486} - md: fix resync softlockup when bitmap size is less than array size (Nigel Croxon) [RHEL-43942] {CVE-2024-38598} - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation (Davide Caratti) [RHEL-39712] {CVE-2024-36017} - netfilter: nf_tables: discard table flag update with pending basechain deletion (Phil Sutter) [RHEL-37205] {CVE-2024-35897} - netfilter: nf_tables: reject table flag and netdev basechain updates (Phil Sutter) [RHEL-37205] - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (Ewan D. Milne) [RHEL-40172] {CVE-2024-36924} - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (Ewan D. Milne) [RHEL-40172] {CVE-2024-36952} - netfilter: nf_tables: fix memleak in map from abort path (Phil Sutter) [RHEL-35052] {CVE-2024-27011} - netfilter: nf_tables: reject new basechain after table flag update (Phil Sutter) [RHEL-37193] {CVE-2024-35900} - netfilter: nf_tables: flush pending destroy work before exit_net release (Phil Sutter) [RHEL-37197] {CVE-2024-35899} - netfilter: complete validation of user input (Phil Sutter) [RHEL-37210] - netfilter: validate user input for expected length (Phil Sutter) [RHEL-37210] {CVE-2024-35896} - netfilter: tproxy: bail out if IP has been disabled on the device (Phil Sutter) [RHEL-44363] {CVE-2024-36270} - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (Phil Sutter) [RHEL-44532] {CVE-2024-36286} - netfilter: nf_tables: do not compare internal table flags on updates (Phil Sutter) [RHEL-35114] {CVE-2024-27065} - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (Phil Sutter) [RHEL-35028] {CVE-2024-27019} - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (Phil Sutter) [RHEL-35024] {CVE-2024-27020} - netfilter: nf_tables: __nft_expr_type_get() selects specific family type (Phil Sutter) [RHEL-35024] - netfilter: conntrack: serialize hash resizes and cleanups (Phil Sutter) [RHEL-37703] {CVE-2021-47408} - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (Phil Sutter) [RHEL-34217] {CVE-2024-26925} - netfilter: nf_tables: release batch on table validation from abort path (Phil Sutter) [RHEL-34217] - ipvlan: add ipvlan_route_v6_outbound() helper (Davide Caratti) [RHEL-38319] {CVE-2023-52796} - [rt] build kernel-rt-4.18.0-553.12.1.rt7.353.el8_10 [RHEL-44553] - net: bridge: xmit: make sure we have at least eth header len bytes (cki-backport-bot) [RHEL-44291] {CVE-2024-38538} - drivers/amd/pm: fix a use-after-free in kv_parse_power_table (Michel Dänzer) [RHEL-26893] {CVE-2023-52469} - SUNRPC: Fix a suspicious RCU usage warning (Scott Mayhew) [RHEL-30503] {CVE-2023-52623} - ice: Fix some null pointer dereference issues in ice_ptp.c (Petr Oros) [RHEL-26901] {CVE-2023-52471} - xfs: fix internal error from AGFL exhaustion (Pavel Reichl) [RHEL-45581] - sched/psi: Fix use-after-free in ep_remove_wait_queue() (Phil Auld) [RHEL-38117] {CVE-2023-52707} - wait: add wake_up_pollfree() (Phil Auld) [RHEL-38117] - net/ipv6: avoid possible UAF in ip6_route_mpath_notify() (Hangbin Liu) [RHEL-33269] {CVE-2024-26852} - net: bridge: switchdev: Skip MDB replays of deferred events on offload (Ivan Vecera) [RHEL-33117] {CVE-2024-26837} - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (Pavel Reichl) [RHEL-31700] {CVE-2024-26772} - ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() (Pavel Reichl) [RHEL-31688] {CVE-2024-26773} - ext4: fix double-free of blocks due to wrong extents moved_len (Pavel Reichl) [RHEL-31612] {CVE-2024-26704} - vxlan: Pull inner IP header in vxlan_xmit_one(). (Guillaume Nault) [RHEL-31389] - geneve: Fix incorrect inner network header offset when innerprotoinherit is set (Guillaume Nault) [RHEL-31389] - vxlan: Pull inner IP header in vxlan_rcv(). (Guillaume Nault) [RHEL-31389] - geneve: fix header validation in geneve[6]_xmit_skb (Guillaume Nault) [RHEL-31389] - geneve: make sure to pull inner header in geneve_rx() (Guillaume Nault) [RHEL-31389] - net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb (Guillaume Nault) [RHEL-31389] - net: geneve: check skb is large enough for IPv4/IPv6 header (Guillaume Nault) [RHEL-31389] - net/smc: fix neighbour and rtable leak in smc_ib_find_route() (Tobias Huschle) [RHEL-39744] {CVE-2024-36945} - igb: Fix string truncation warnings in igb_set_fw_version (Corinna Vinschen) [RHEL-38452] {CVE-2024-36010} - bonding: stop the device in bond_setup_by_slave() (Hangbin Liu) [RHEL-38327] {CVE-2023-52784} - i40e: fix vf may be used uninitialized in this function warning (Kamal Heib) [RHEL-39702] {CVE-2024-36020} - powerpc/64: Fix the definition of the fixmap area (Mamatha Inamdar) [RHEL-27191] {CVE-2021-47018} - powerpc/mm/hash64: Add a variable to track the end of IO mapping (Mamatha Inamdar) [RHEL-27191] {CVE-2021-47018} - nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). (Xin Long) [RHEL-39770] {CVE-2024-36933} - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (Xin Long) [RHEL-39770] - net: core: reject skb_copy(_expand) for fraglist GSO skbs (Xin Long) [RHEL-39779] {CVE-2024-36929} - tcp: properly terminate timers for kernel sockets (Guillaume Nault) [RHEL-37171] {CVE-2024-35910} - net: relax socket state check at accept time. (Florian Westphal) [RHEL-39831] - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (Florian Westphal) [RHEL-39831] {CVE-2024-36905} - tcp: remove redundant check on tskb (Florian Westphal) [RHEL-39831] - drm/ast: Fix soft lockup (cki-backport-bot) [RHEL-37438] {CVE-2024-35952} - null_blk: Fix return value of nullb_device_power_store() (Ming Lei) [RHEL-39341] - null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues' (Ming Lei) [RHEL-39341] - null_blk: fix return value from null_add_dev() (Ming Lei) [RHEL-39341] - [rt] build kernel-rt-4.18.0-553.11.1.rt7.352.el8_10 [RHEL-44553] - x86/bugs: Reverse instruction order of CLEAR_CPU_BUFFERS (Waiman Long) [RHEL-42121] - Revert "x86/bugs: Use fixed addressing for VERW operand" (Waiman Long) [RHEL-42121] - KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests (Waiman Long) [RHEL-42121] - x86/rfds: Mitigate Register File Data Sampling (RFDS) (Waiman Long) [RHEL-42121] - Documentation/hw-vuln: Add documentation for RFDS (Waiman Long) [RHEL-42121] - x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set (Waiman Long) [RHEL-42121] - x86/bugs: Use fixed addressing for VERW operand (Waiman Long) [RHEL-42121] - KVM/VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH (Waiman Long) [RHEL-42121] - x86/bugs: Use ALTERNATIVE() instead of mds_user_clear static key (Waiman Long) [RHEL-42121] - x86/entry_32: Add VERW just before userspace transition (Waiman Long) [RHEL-42121] - x86/entry_64: Add VERW just before userspace transition (Waiman Long) [RHEL-42121] - x86/bugs: Add asm helpers for executing VERW (Waiman Long) [RHEL-42121] - x86/cpu: Fix Gracemont uarch (Waiman Long) [RHEL-42121] - Documentation/hw-vuln: Unify filename specification in index (Waiman Long) [RHEL-42121] - KVM: VMX: Access @flags as a 32-bit value in __vmx_vcpu_run() (Waiman Long) [RHEL-42121] - x86/asm: Add _ASM_RIP() macro for x86-64 (%rip) suffix (Waiman Long) [RHEL-42121] - x86/asm: Have the __ASM_FORM macros handle commas in arguments (Waiman Long) [RHEL-42121] - x86/asm: Allow to pass macros to __ASM_FORM() (Waiman Long) [RHEL-42121] - wifi: iwlwifi: mvm: guard against invalid STA ID on removal (Jose Ignacio Tornos Martinez) [RHEL-39801] {CVE-2024-36921} - ipv6: Fix potential uninit-value access in __ip6_make_skb() (Antoine Tenart) [RHEL-39784] - ipv4: Fix uninit-value access in __ip_make_skb() (Antoine Tenart) [RHEL-39784] {CVE-2024-36927} - perf mmap: Lazily initialize zstd streams to save memory when not using it (Michael Petlan) [RHEL-34876] - perf tools: Fix spelling mistake "commpressor" -> "compressor" (Michael Petlan) [RHEL-34876] - perf record: Introduce data transferred and compressed stats (Michael Petlan) [RHEL-34876] - perf record: Introduce compressor at mmap buffer object (Michael Petlan) [RHEL-34876] - perf record: Introduce bytes written stats (Michael Petlan) [RHEL-34876] - perf record: Introduce data file at mmap buffer object (Michael Petlan) [RHEL-34876] - perf record: Start threads in the beginning of trace streaming (Alexey Bayduraev) [RHEL-34876] - perf record: Stop threads in the end of trace streaming (Michael Petlan) [RHEL-34876] - perf record: Introduce thread local variable (Michael Petlan) [RHEL-34876] - perf record: Introduce function to propagate control commands (Michael Petlan) [RHEL-34876] - perf record: Introduce thread specific data array (Michael Petlan) [RHEL-34876] - tools lib: Introduce fdarray duplicate function (Michael Petlan) [RHEL-34876] - perf record: Introduce thread affinity and mmap masks (Michael Petlan) [RHEL-34876] - gfs2: Be more careful with the quota sync generation (Andreas Gruenbacher) [RHEL-40901] - gfs2: Get rid of some unnecessary quota locking (Andreas Gruenbacher) [RHEL-40901] - gfs2: Add some missing quota locking (Andreas Gruenbacher) [RHEL-40901] - gfs2: Fold qd_fish into gfs2_quota_sync (Andreas Gruenbacher) [RHEL-40901] - gfs2: quota need_sync cleanup (Andreas Gruenbacher) [RHEL-40901] - gfs2: Fix and clean up function do_qc (Andreas Gruenbacher) [RHEL-40901] - gfs2: Revert "Add quota_change type" (Andreas Gruenbacher) [RHEL-40901] - gfs2: Revert "ignore negated quota changes" (Andreas Gruenbacher) [RHEL-40901] - gfs2: qd_check_sync cleanups (Andreas Gruenbacher) [RHEL-40901] - gfs2: Check quota consistency on mount (Andreas Gruenbacher) [RHEL-40901] - gfs2: Minor gfs2_quota_init error path cleanup (Andreas Gruenbacher) [RHEL-40901] - gfs2: fix kernel BUG in gfs2_quota_cleanup (Edward Adam Davis) [RHEL-40901] - gfs2: Clean up quota.c:print_message (Andreas Gruenbacher) [RHEL-40901] - gfs2: Clean up gfs2_alloc_parms initializers (Andreas Gruenbacher) [RHEL-40901] - gfs2: Two quota=account mode fixes (Andreas Gruenbacher) [RHEL-40901] - gfs2: Remove useless assignment (Bob Peterson) [RHEL-40901] - gfs2: simplify slot_get (Bob Peterson) [RHEL-40901] - gfs2: Simplify qd2offset (Bob Peterson) [RHEL-40901] - gfs2: Remove quota allocation info from quota file (Bob Peterson) [RHEL-40901] - gfs2: use constant for array size (Bob Peterson) [RHEL-40901] - gfs2: Set qd_sync_gen in do_sync (Bob Peterson) [RHEL-40901] - gfs2: Remove useless err set (Bob Peterson) [RHEL-40901] - gfs2: Small gfs2_quota_lock cleanup (Bob Peterson) [RHEL-40901] - gfs2: move qdsb_put and reduce redundancy (Bob Peterson) [RHEL-40901] - gfs2: Don't try to sync non-changes (Bob Peterson) [RHEL-40901] - gfs2: Simplify function need_sync (Bob Peterson) [RHEL-40901] - gfs2: remove unneeded pg_oflow variable (Bob Peterson) [RHEL-40901] - gfs2: remove unneeded variable done (Bob Peterson) [RHEL-40901] - gfs2: pass sdp to gfs2_write_buf_to_page (Bob Peterson) [RHEL-40901] - gfs2: pass sdp in to gfs2_write_disk_quota (Bob Peterson) [RHEL-40901] - gfs2: Pass sdp to gfs2_adjust_quota (Bob Peterson) [RHEL-40901] - gfs2: remove dead code for quota writes (Bob Peterson) [RHEL-40901] - gfs2: Use qd_sbd more consequently (Bob Peterson) [RHEL-40901] - gfs2: replace 'found' with dedicated list iterator variable (Jakob Koschel) [RHEL-40901] - gfs2: Some whitespace cleanups (Andreas Gruenbacher) [RHEL-40901] - gfs2: Fix gfs2_qa_get imbalance in gfs2_quota_hold (Bob Peterson) [RHEL-40901] - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg (Guillaume Nault) [RHEL-43961] {CVE-2024-38596} - af_unix: Fix data-races around sk->sk_shutdown. (Guillaume Nault) [RHEL-43961] {CVE-2024-38596} - af_unix: Fix data races around sk->sk_shutdown. (Guillaume Nault) [RHEL-43961] {CVE-2024-38596} - perf/core: Fix event sibling list locking (Daniel Vacek) [RHEL-31798] - media: bttv: fix use after free error due to btv->timeout timer (Kate Hsuan) [RHEL-38256] {CVE-2023-52847} - arp: Prevent overflow in arp_req_get(). (Antoine Tenart) [RHEL-31706] {CVE-2024-26733} - Bluetooth: btusb: Add a new PID/VID 0489/e0c8 for MT7921 (David Marlin) [RHEL-10263] - mm: swap: fix race between free_swap_and_cache() and swapoff() (Waiman Long) [RHEL-34971] {CVE-2024-26960} - swap: comments get_swap_device() with usage rule (Waiman Long) [RHEL-34971] {CVE-2024-26960} - mm/swapfile.c: __swap_entry_free() always free 1 entry (Waiman Long) [RHEL-34971] {CVE-2024-26960} - mm/swapfile.c: call free_swap_slot() in __swap_entry_free() (Waiman Long) [RHEL-34971] {CVE-2024-26960} - mm/swapfile.c: use __try_to_reclaim_swap() in free_swap_and_cache() (Waiman Long) [RHEL-34971] {CVE-2024-26960} - net: amd-xgbe: Fix skb data length underflow (Ken Cox) [RHEL-43788] {CVE-2022-48743} - ovl: fix warning in ovl_create_real() (cki-backport-bot) [RHEL-43652] {CVE-2021-47579} - net/sched: initialize noop_qdisc owner (Davide Caratti) [RHEL-35056] - net/sched: Fix mirred deadlock on device recursion (Davide Caratti) [RHEL-35056] {CVE-2024-27010} - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (Pavel Reichl) [RHEL-45029] {CVE-2024-39276} - ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() (Ken Cox) [RHEL-38713] {CVE-2021-47548} - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound (Hangbin Liu) [RHEL-44396] {CVE-2024-33621} - mlxsw: spectrum_acl_tcam: Fix stack corruption (Ivan Vecera) [RHEL-26462] {CVE-2024-26586} - inet: inet_defrag: prevent sk release while still in use (Antoine Tenart) [RHEL-33398] {CVE-2024-26921} - skb_expand_head() adjust skb->truesize incorrectly (Antoine Tenart) [RHEL-33398] - nvmet: fix ns enable/disable possible hang (Ming Lei) [RHEL-43547] - [rt] build kernel-rt-4.18.0-553.10.1.rt7.351.el8_10 [RHEL-44553] - SUNRPC: Fix RPC client cleaned up the freed pipefs dentries (Scott Mayhew) [RHEL-38264] {CVE-2023-52803} - scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() (Ewan D. Milne) [RHEL-39717] {CVE-2024-36025} - tcp: add sanity checks to rx zerocopy (Guillaume Nault) [RHEL-29494] {CVE-2024-26640} - SUNRPC: fix some memleaks in gssx_dec_option_array (Scott Mayhew) [RHEL-35209] {CVE-2024-27388} - wifi: nl80211: don't free NULL coalescing rule (Jose Ignacio Tornos Martinez) [RHEL-39752] {CVE-2024-36941} - nfs: fix UAF in direct writes (Scott Mayhew) [RHEL-34975] {CVE-2024-26958} - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 (Scott Mayhew) [RHEL-33228] {CVE-2024-26870} - drm/amd/pm: Fix error of MACO flag setting code (Michel Dänzer) [RHEL-15928] - scsi: aacraid: fix io hangs and improve performance (John Meneghini) [RHEL-23913] - block: prevent division by zero in blk_rq_stat_sum() (Ming Lei) [RHEL-37279] {CVE-2024-35925} - block: fix overflow in blk_ioctl_discard() (Ming Lei) [RHEL-39811] {CVE-2024-36917} - virtio-blk: fix implicit overflow on virtio_max_dma_size (Ming Lei) [RHEL-38131] {CVE-2023-52762} - nbd: null check for nla_nest_start (Ming Lei) [RHEL-35176] {CVE-2024-27025} - isdn: mISDN: netjet: Fix crash in nj_probe: (Ken Cox) [RHEL-38444] {CVE-2021-47284} - isdn: mISDN: Fix sleeping function called from invalid context (Ken Cox) [RHEL-38400] {CVE-2021-47468} - net/smc: avoid data corruption caused by decline (Tobias Huschle) [RHEL-38234] {CVE-2023-52775} - ubi: Check for too small LEB size in VTBL code (David Arcari) [RHEL-25092] {CVE-2024-25739} - i2c: core: Fix atomic xfer check for non-preempt config (Steve Best) [RHEL-38313] {CVE-2023-52791} - i2c: core: Run atomic i2c xfer when !preemptible (Steve Best) [RHEL-38313] {CVE-2023-52791} - firewire: ohci: mask bus reset interrupts between ISR and bottom half (Steve Best) [RHEL-39902] {CVE-2024-36950} - ipv6: init the accept_queue's spinlocks in inet6_create (Guillaume Nault) [RHEL-28899] {CVE-2024-26614} - tcp: make sure init the accept_queue's spinlocks once (Guillaume Nault) [RHEL-28899] {CVE-2024-26614} - tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (Steve Best) [RHEL-39352] {CVE-2024-36016} - mlxsw: spectrum_acl_tcam: Fix incorrect list API usage (Ivan Vecera) [RHEL-37484] {CVE-2024-36006} - pwm: Fix double shift bug (Steve Best) [RHEL-38278] {CVE-2023-52756} - mmc: sdio: fix possible resource leaks in some error paths (Steve Best) [RHEL-38149] {CVE-2023-52730} - of: unittest: Fix compile in the non-dynamic case (Steve Best) [RHEL-37070] {CVE-2023-52679} - of: unittest: Fix of_count_phandle_with_args() expected value message (Steve Best) [RHEL-37070] {CVE-2023-52679} - of: Fix double free in of_parse_phandle_with_args_map (Steve Best) [RHEL-37070] {CVE-2023-52679} - pinctrl: core: delete incorrect free in pinctrl_enable() (Steve Best) [RHEL-39756] {CVE-2024-36940} - pinctrl: core: fix possible memory leak in pinctrl_enable() (Steve Best) [RHEL-39756] {CVE-2024-36940} - media: gspca: cpia1: shift-out-of-bounds in set_flicker (Desnes Nunes) [RHEL-38331] {CVE-2023-52764} - tipc: fix a possible memleak in tipc_buf_append (Xin Long) [RHEL-39881] {CVE-2024-36954} - cifs: fix mid leak during reconnection after timeout threshold (Paulo Alcantara) [RHEL-36222] - cifs: Fix use-after-free in rdata->read_into_pages() (Paulo Alcantara) [RHEL-36222] - cifs: Fix pages leak when writedata alloc failed in cifs_write_from_iter() (Paulo Alcantara) [RHEL-36222] - cifs: Fix pages array leak when writedata alloc failed in cifs_writedata_alloc() (Paulo Alcantara) [RHEL-36222] - cifs: destage dirty pages before re-reading them for cache=none (Paulo Alcantara) [RHEL-36222] - cifs: destage any unwritten data to the server before calling copychunk_write (Paulo Alcantara) [RHEL-36222] - Adjust cifssb maximum read size (Paulo Alcantara) [RHEL-36222] - cifs: make locking consistent around the server session status (Paulo Alcantara) [RHEL-36222] - cifs: fix credit accounting for extra channel (Paulo Alcantara) [RHEL-36222] - smb3: prevent races updating CurrentMid (Paulo Alcantara) [RHEL-36222] - cifs: fix missing spinlock around update to ses->status (Paulo Alcantara) [RHEL-36222] - cifs: use echo_interval even when connection not ready. (Paulo Alcantara) [RHEL-36222] - cifs: detect dead connections only when echoes are enabled. (Paulo Alcantara) [RHEL-36222] - cifs: Fix preauth hash corruption (Paulo Alcantara) [RHEL-36222] - cifs: do not send close in compound create+close requests (Paulo Alcantara) [RHEL-36222] - cifs: ask for more credit on async read/write code paths (Paulo Alcantara) [RHEL-36222] - cifs: use discard iterator to discard unneeded network data more efficiently (Paulo Alcantara) [RHEL-36222] - cifs: Fix in error types returned for out-of-credit situations. (Paulo Alcantara) [RHEL-36222] - smb3: fix crediting for compounding when only one request in flight (Paulo Alcantara) [RHEL-36222] - cifs: New optype for session operations. (Paulo Alcantara) [RHEL-36222] - mm/gup: do not return 0 from pin_user_pages_fast() for bad args (Paulo Alcantara) [RHEL-36222] - wifi: brcmfmac: pcie: handle randbuf allocation failure (Jose Ignacio Tornos Martinez) [RHEL-44124] {CVE-2024-38575} - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). (Guillaume Nault) [RHEL-39835] {CVE-2024-36904} - wifi: mac80211: don't return unset power in ieee80211_get_tx_power() (Jose Ignacio Tornos Martinez) [RHEL-38159] {CVE-2023-52832} - wifi: ath11k: fix gtk offload status event locking (Jose Ignacio Tornos Martinez) [RHEL-38155] {CVE-2023-52777} - net: ieee802154: fix null deref in parse dev addr (Steve Best) [RHEL-38012] {CVE-2021-47257} - mm/hugetlb: fix missing hugetlb_lock for resv uncharge (Rafael Aquini) [RHEL-37465] {CVE-2024-36000} - x86/xen: Add some null pointer checking to smp.c (Vitaly Kuznetsov) [RHEL-33258] {CVE-2024-26908} - x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() (Vitaly Kuznetsov) [RHEL-33258] {CVE-2024-26908} - wifi: cfg80211: check A-MSDU format more carefully (Jose Ignacio Tornos Martinez) [RHEL-37343] {CVE-2024-35937} - wifi: rtw89: fix null pointer access when abort scan (Jose Ignacio Tornos Martinez) [RHEL-37355] {CVE-2024-35946} - atl1c: Work around the DMA RX overflow issue (Ken Cox) [RHEL-38287] {CVE-2023-52834} - wifi: ath11k: decrease MHI channel buffer length to 8KB (Jose Ignacio Tornos Martinez) [RHEL-37339] {CVE-2024-35938} - wifi: iwlwifi: mvm: rfi: fix potential response leaks (Jose Ignacio Tornos Martinez) [RHEL-37163] {CVE-2024-35912} - USB: core: Fix access violation during port device removal (Desnes Nunes) [RHEL-39853] {CVE-2024-36896} - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() (Ewan D. Milne) [RHEL-37123] {CVE-2024-35930} - netfilter: nf_tables: honor table dormant flag from netdev release event path (Phil Sutter) [RHEL-37450] {CVE-2024-36005} - wifi: iwlwifi: mvm: don't set the MFP flag for the GTK (Jose Ignacio Tornos Martinez) [RHEL-36898] {CVE-2024-27434} - wifi: iwlwifi: mvm: Fix key flags for IGTK on AP interface (Jose Ignacio Tornos Martinez) [RHEL-36898] {CVE-2024-27434} - misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspend/resume (Steve Best) [RHEL-36932] {CVE-2024-35824} - [rt] build kernel-rt-4.18.0-553.9.1.rt7.350.el8_10 [RHEL-44553] - x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (Steve Best) [RHEL-37262] {CVE-2024-35876} - net/sched: flower: Fix chain template offload (Xin Long) [RHEL-31313] {CVE-2024-26669} - SUNRPC: fix a memleak in gss_import_v2_context (Scott Mayhew) [RHEL-35195] {CVE-2023-52653} - efivarfs: force RO when remounting if SetVariable is not supported (Pavel Reichl) [RHEL-26564] {CVE-2023-52463} - dmaengine: idxd: add a write() method for applications to submit work (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823} - dmaengine: idxd: add a new security check to deal with a hardware erratum (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823} - VFIO: Add the SPR_DSA and SPR_IAX devices to the denylist (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823} - quota: Fix potential NULL pointer dereference (Pavel Reichl) [RHEL-33219] {CVE-2024-26878} - locking/lockdep: Fix overflow in presentation of average lock-time (Čestmír Kalina) [RHEL-17678] - blk-cgroup: Properly propagate the iostat update up the hierarchy (Ming Lei) [RHEL-40939] - proc: Use new_inode not new_inode_pseudo (Ian Kent) [RHEL-40167] - stmmac: Clear variable when destroying workqueue (Izabela Bakollari) [RHEL-31822] {CVE-2024-26802} - powerpc/pseries/memhp: Fix access beyond end of drmem array (Mamatha Inamdar) [RHEL-26495] {CVE-2023-52451} - platform/x86: wmi: Fix opening of char device (David Arcari) [RHEL-38258] {CVE-2023-52864} - Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" (Kamal Heib) [RHEL-36908] {CVE-2023-52658} - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed (Cathy Avery) [RHEL-39074] - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove (Cathy Avery) [RHEL-39074] - hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes (Cathy Avery) [RHEL-39074] - hv_netvsc: remove duplicated including of slab.h (Cathy Avery) [RHEL-39074] - hv_netvsc: rndis_filter needs to select NLS (Cathy Avery) [RHEL-39074] - hv_netvsc: Mark VF as slave before exposing it to user-mode (Cathy Avery) [RHEL-39074] - hv_netvsc: Fix race of register_netdevice_notifier and VF register (Cathy Avery) [RHEL-39074] - hv_netvsc: fix race of netvsc and VF register_netdevice (Cathy Avery) [RHEL-39074] - hv_netvsc: fix netvsc_send_completion to avoid multiple message length checks (Cathy Avery) [RHEL-39074] - hv_netvsc: Allocate rx indirection table size dynamically (Cathy Avery) [RHEL-39074] - net: hv_netvsc: Fix a warning triggered by memcpy in rndis_filter (Cathy Avery) [RHEL-39074] - gfs2: Fix lru_count accounting (Andreas Gruenbacher) [RHEL-32941] - gfs2: Fix "Make glock lru list scanning safer" (Andreas Gruenbacher) [RHEL-32941] - gfs2: Fix "ignore unlock failures after withdraw" (Andreas Gruenbacher) [RHEL-32941] - gfs2: Don't set GLF_LOCK in gfs2_dispose_glock_lru (Andreas Gruenbacher) [RHEL-32941] - gfs2: Don't forget to complete delayed withdraw (Andreas Gruenbacher) [RHEL-32941] - gfs2: Delay withdraw from atomic context (Andreas Gruenbacher) [RHEL-32941] - gfs2: trivial clean up of gfs2_ail_error (Andreas Gruenbacher) [RHEL-32941] - ext4: fix corruption during on-line resize (Carlos Maiolino) [RHEL-36974] {CVE-2024-35807} - ext4: correct offset of gdb backup in non meta_bg group to update_backups (Carlos Maiolino) [RHEL-36974] - ext4: avoid online resizing failures due to oversized flex bg (Carlos Maiolino) [RHEL-30507] {CVE-2023-52622} - ext4: use time_is_before_jiffies() instead of open coding it (Carlos Maiolino) [RHEL-30507] - ext4: unify the type of flexbg_size to unsigned int (Carlos Maiolino) [RHEL-30507] - ext4: remove unnecessary check from alloc_flex_gd() (Carlos Maiolino) [RHEL-30507] - tracing: Do no increment trace_clock_global() by one (Jerome Marchand) [RHEL-27107] {CVE-2021-46939} - tracing: Restructure trace_clock_global() to never block (Jerome Marchand) [RHEL-27107] {CVE-2021-46939} - net/sched: act_skbmod: prevent kernel-infoleak (Xin Long) [RHEL-37220] {CVE-2024-35893} - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (Xin Long) [RHEL-38307] {CVE-2023-52845} - redhat: remove the merge subtrees script (Derek Barbosa) - redhat: rhdocs: delete .get_maintainer.conf (Derek Barbosa) - redhat: rhdocs: Remove the rhdocs directory (Derek Barbosa) - dyndbg: fix old BUG_ON in >control parser (Waiman Long) [RHEL-37111] {CVE-2024-35947} - dyndbg: let query-modname override actual module name (Waiman Long) [RHEL-37111] - dyndbg: make dyndbg a known cli param (Waiman Long) [RHEL-37111] - lan78xx: Fix exception on link speed change (Jamie Bainbridge) [RHEL-33437] - net: usb: lan78xx: don't modify phy_device state concurrently (Jamie Bainbridge) [RHEL-33437] - efi: runtime: Fix potential overflow of soft-reserved region size (Lenny Szubowicz) [RHEL-33096] {CVE-2024-26843} - perf/arm-cmn: Fail DTC counter allocation correctly (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Rework DTC counters (again) (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Fix DTC domain detection (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Revamp model detection (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Fix port detection for CMN-700 (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Move overlapping wp_combine field (Michael Petlan) [RHEL-23841] - Partially revert "perf/arm-cmn: Optimise DTC counter accesses" (Michael Petlan) [RHEL-23841] - drivers/perf: Compile with gnu99 standard (Michael Petlan) [RHEL-23841] - x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (Steve Best) [RHEL-36994] {CVE-2024-35801} - watchdog: softdog: Add options 'soft_reboot_cmd' and 'soft_active_on_boot' (Waiman Long) [RHEL-19723] - tipc: fix UAF in error path (Xin Long) [RHEL-34278] {CVE-2024-36886} - [rt] build kernel-rt-4.18.0-553.8.1.rt7.349.el8_10 [RHEL-40882] - udf: Fix NULL pointer dereference in udf_symlink function (Pavel Reichl) [RHEL-37769] {CVE-2021-47353} - net: ti: fix UAF in tlan_remove_one (Jose Ignacio Tornos Martinez) [RHEL-38940] {CVE-2021-47310} - ARM: footbridge: fix PCI interrupt mapping (Myron Stowe) [RHEL-26971] {CVE-2021-46909} - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (Kamal Heib) [RHEL-37454] {CVE-2024-36004} - net/mlx5e: Fix mlx5e_priv_init() cleanup flow (Kamal Heib) [RHEL-37424] {CVE-2024-35959} - net/mlx5: Properly link new fs rules into the tree (Kamal Heib) [RHEL-37420] {CVE-2024-35960} - net/mlx5e: fix a potential double-free in fs_any_create_groups (Kamal Heib) [RHEL-37091] {CVE-2023-52667} - net: ena: Fix incorrect descriptor free behavior (Kamal Heib) [RHEL-37428] {CVE-2024-35958} - mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - mISDN: fix possible use-after-free in HFC_cleanup() (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - implement dh fallback for primes > 4K (Vladis Dronov) [RHEL-35106] - crypto: qat - avoid division by zero (Vladis Dronov) [RHEL-35106] - crypto: qat - resolve race condition during AER recovery (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - use kcalloc_node() instead of kzalloc_node() (Vladis Dronov) [RHEL-35106] - [rt] Enable CONFIG_DRM_MGAG200_DISABLE_WRITECOMBINE (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Add an option to disable Write-Combine (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Fix caching setup for remapped video memory (Jocelyn Falempe) [RHEL-36172] - Revert "drm/mgag200: Add a workaround for low-latency" (Jocelyn Falempe) [RHEL-36172] - mptcp: fix data re-injection from stale subflow (Davide Caratti) [RHEL-33133] {CVE-2024-26826} - ipv6: sr: fix incorrect unregister order (Hangbin Liu) [RHEL-31730] - ipv6: sr: fix possible use-after-free and null-ptr-deref (Hangbin Liu) [RHEL-31730] {CVE-2024-26735} - net/bnx2x: Prevent access to a freed page in page_pool (Michal Schmidt) [RHEL-14195 RHEL-33243] {CVE-2024-26859} - bnx2x: new flag for track HW resource allocation (Michal Schmidt) [RHEL-14195 RHEL-33243] - bnx2x: fix page fault following EEH recovery (Michal Schmidt) [RHEL-14195 RHEL-33243] - x86: KVM: SVM: always update the x2avic msr interception (Maxim Levitsky) [RHEL-15495] {CVE-2023-5090} - EDAC/thunderx: Fix possible out-of-bounds string access (Aristeu Rozanski) [RHEL-26573] {CVE-2023-52464} - [rt] build kernel-rt-4.18.0-553.7.1.rt7.348.el8_10 [RHEL-34640] - net: qcom/emac: fix UAF in emac_remove (Ken Cox) [RHEL-37834] {CVE-2021-47311} - perf/core: Bail out early if the request AUX area is out of bound (Michael Petlan) [RHEL-38268] {CVE-2023-52835} - crypto: pcrypt - Fix hungtask for PADATA_RESET (Herbert Xu) [RHEL-38171] {CVE-2023-52813} - drm/amdgpu: fix use-after-free bug (Jocelyn Falempe) [RHEL-31240] {CVE-2024-26656} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash (Ivan Vecera) [RHEL-37008] {CVE-2024-35854} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update (Ivan Vecera) [RHEL-37004] {CVE-2024-35855} - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (Ivan Vecera) [RHEL-37012] {CVE-2024-35853} - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work (Ivan Vecera) [RHEL-37016] {CVE-2024-35852} - mlxsw: spectrum_acl_tcam: Fix warning during rehash (Ivan Vecera) [RHEL-37480] {CVE-2024-36007} - can: peak_pci: peak_pci_remove(): fix UAF (Jose Ignacio Tornos Martinez) [RHEL-38419] {CVE-2021-47456} - usbnet: fix error return code in usbnet_probe() (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - usbnet: sanity check for maxpacket (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - net/mlx5e: fix a double-free in arfs_create_groups (Kamal Heib) [RHEL-36920] {CVE-2024-35835} - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds (Jose Ignacio Tornos Martinez) [RHEL-38220] {CVE-2023-52878} - net: cdc_eem: fix tx fixup skb leak (Jose Ignacio Tornos Martinez) [RHEL-38080] {CVE-2021-47236} - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Jose Ignacio Tornos Martinez) [RHEL-38113] {CVE-2023-52703} - usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() (Desnes Nunes) [RHEL-38248] {CVE-2023-52877} - usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (Desnes Nunes) [RHEL-38240] {CVE-2023-52781} - gro: fix ownership transfer (Xin Long) [RHEL-37226] {CVE-2024-35890} - tipc: fix kernel warning when sending SYN message (Xin Long) [RHEL-38109] {CVE-2023-52700} - erspan: make sure erspan_base_hdr is present in skb->head (Xin Long) [RHEL-37230] {CVE-2024-35888} - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() (Bryan Gurney) [RHEL-17366] - scsi: mpi3mr: Sanitise num_phys (Bryan Gurney) [RHEL-17366] - netfilter: nf_tables: use timestamp to check for set element timeout (Phil Sutter) [RHEL-38023] {CVE-2024-27397} - net/ipv6: SKB symmetric hash should incorporate transport ports (Sabrina Dubroca) [RHEL-32061] - crypto: s390/aes - Fix buffer overread in CTR mode (Herbert Xu) [RHEL-37089] {CVE-2023-52669} - net: Save and restore msg_namelen in sock_sendmsg (Jamie Bainbridge) [RHEL-35893] - net: prevent address rewrite in kernel_bind() (Jamie Bainbridge) [RHEL-35893] - net: prevent rewrite of msg_name in sock_sendmsg() (Jamie Bainbridge) [RHEL-35893] - net: replace calls to sock->ops->connect() with kernel_connect() (Jamie Bainbridge) [RHEL-35893] - net: Avoid address overwrite in kernel_connect (Jamie Bainbridge) [RHEL-35893] - wifi: iwlwifi: dbg-tlv: ensure NUL termination (Jose Ignacio Tornos Martinez) [RHEL-37026] {CVE-2024-35845} - wifi: mac80211: fix potential sta-link leak (Jose Ignacio Tornos Martinez) [RHEL-36916] {CVE-2024-35838} - wifi: nl80211: reject iftype change with mesh ID change (Jose Ignacio Tornos Martinez) [RHEL-36884] {CVE-2024-27410} - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (Jose Ignacio Tornos Martinez) [RHEL-36807] {CVE-2024-35789} - Bluetooth: Avoid potential use-after-free in hci_error_reset (David Marlin) [RHEL-31826] {CVE-2024-26801} - tls: disable async encrypt/decrypt (Sabrina Dubroca) [RHEL-26362 RHEL-26409 RHEL-26420] {CVE-2024-26585 CVE-2024-26583 CVE-2024-26584} - Squashfs: check the inode number is not the invalid value of zero (Phillip Lougher) [RHEL-35096] {CVE-2024-26982} - ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/msg.c: update and document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/sem.c: document and update memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: update/document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: remove duplicated code (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (Kamal Heib) [RHEL-30582] {CVE-2023-52626} - Revert "ACPI: bus: Rework system-level device notification handling" (Prarit Bhargava) [RHEL-21486] - hwrng: core - Fix page fault dead lock on mmap-ed hwrng (Prarit Bhargava) [RHEL-29485] {CVE-2023-52615} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - powerpc/pseries: pci - logic bug (Mamatha Inamdar) [RHEL-240146] - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228} - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899] {CVE-2026-90036} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680] {CVE-2026-72262} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641} - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781] {CVE-2026-74583} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916] {CVE-2026-68377} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271288] {CVE-2026-89631} - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280060] {CVE-2026-98320} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271853] {CVE-2026-93817} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191034] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191034] {CVE-2026-53196} - gfs2: a minor finish_xmote cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor run_queue fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: only apply DLM_LKF_VALBLK if sb_lvbptr is not NULL (Alexander Aring) [RHEL-129363] - gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Use wait_event_freezable_timeout() for freezable kthread (Andreas Gruenbacher) [RHEL-129363] - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-129363] - gfs2: low-memory forced flush fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: add missing withdraw locking (Andreas Gruenbacher) [RHEL-129363] - gfs2: Disable GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename "gfs_recovery" workqueue to "gfs2_recovery" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-129363] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-129363] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify do_promote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-129363] - gfs2: introduce new gfs2_glock_assert_withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify refcounting in do_xmote (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Make recovery error more readable (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark the remaining process-independent glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark flock glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of newlines in log messages (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-129363] - gfs2: Sanitize kthread stopping (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix logd wakeup on I/O error (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_quotad (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_logd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove duplicate check in do_xmote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove space before newline (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix LM_FLAG_TRY* logic in add_to_queue (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove DLM_LKF_ALTCW / DLM_LKF_ALTPR code (Andreas Gruenbacher) [RHEL-129363] - gfs2: Further sanitize lock_dlm.c (Andreas Gruenbacher) [RHEL-129363] - gfs2: sanitize the gdlm_ast -> finish_xmote interface (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify DLM_LKF_QUECVT use (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-129363] - gfs2: Lift withdraw check out of gfs2_ail1_empty (Andreas Gruenbacher) [RHEL-129363] - gfs2: don't withdraw if init_threads() got interrupted (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-129363] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix slab-use-after-free in gfs2_qd_dealloc (Andreas Gruenbacher) [RHEL-129363] {CVE-2023-52760} - gfs2: Fix asynchronous thread destruction (Andreas Gruenbacher) [RHEL-129363] - gfs2: Stop using gfs2_make_fs_ro for withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-129363] - gfs2: Turn gfs2_withdraw into a void function (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark withdraws as unlikely (Andreas Gruenbacher) [RHEL-129363] - gfs2: ignore rindex_update failure in dinode_dealloc (Andreas Gruenbacher) [RHEL-129363] - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270732] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256684] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256684] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256684] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271657] {CVE-2026-93288} - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254282] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-263292] {CVE-2026-89479} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254357] {CVE-2026-74588} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222954] {CVE-2026-52935} - powerpc/pseries: pci - logic bug (Mamatha Inamdar) [RHEL-240146] - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228} - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899] {CVE-2026-90036} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680] {CVE-2026-72262} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641} - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781] {CVE-2026-74583} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916] {CVE-2026-68377} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270905] {CVE-2026-89777} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263644] {CVE-2026-68202} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254200] {CVE-2026-80590} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233134] {CVE-2026-64572} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225459] {CVE-2026-64114} - xfs: bounds-check buffer log item's dirty bitmap (CKI Backport Bot) [RHEL-253365] {CVE-2026-80536} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234242] {CVE-2026-64266} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271288] {CVE-2026-89631} - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280060] {CVE-2026-98320} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271853] {CVE-2026-93817} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191034] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191034] {CVE-2026-53196} - gfs2: a minor finish_xmote cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor run_queue fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: only apply DLM_LKF_VALBLK if sb_lvbptr is not NULL (Alexander Aring) [RHEL-129363] - gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Use wait_event_freezable_timeout() for freezable kthread (Andreas Gruenbacher) [RHEL-129363] - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-129363] - gfs2: low-memory forced flush fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: add missing withdraw locking (Andreas Gruenbacher) [RHEL-129363] - gfs2: Disable GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename "gfs_recovery" workqueue to "gfs2_recovery" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-129363] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-129363] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify do_promote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-129363] - gfs2: introduce new gfs2_glock_assert_withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify refcounting in do_xmote (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Make recovery error more readable (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark the remaining process-independent glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark flock glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of newlines in log messages (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-129363] - gfs2: Sanitize kthread stopping (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix logd wakeup on I/O error (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_quotad (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_logd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove duplicate check in do_xmote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove space before newline (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix LM_FLAG_TRY* logic in add_to_queue (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove DLM_LKF_ALTCW / DLM_LKF_ALTPR code (Andreas Gruenbacher) [RHEL-129363] - gfs2: Further sanitize lock_dlm.c (Andreas Gruenbacher) [RHEL-129363] - gfs2: sanitize the gdlm_ast -> finish_xmote interface (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify DLM_LKF_QUECVT use (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-129363] - gfs2: Lift withdraw check out of gfs2_ail1_empty (Andreas Gruenbacher) [RHEL-129363] - gfs2: don't withdraw if init_threads() got interrupted (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-129363] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix slab-use-after-free in gfs2_qd_dealloc (Andreas Gruenbacher) [RHEL-129363] {CVE-2023-52760} - gfs2: Fix asynchronous thread destruction (Andreas Gruenbacher) [RHEL-129363] - gfs2: Stop using gfs2_make_fs_ro for withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-129363] - gfs2: Turn gfs2_withdraw into a void function (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark withdraws as unlikely (Andreas Gruenbacher) [RHEL-129363] - gfs2: ignore rindex_update failure in dinode_dealloc (Andreas Gruenbacher) [RHEL-129363] - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270732] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256684] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256684] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256684] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271657] {CVE-2026-93288} - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254282] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-263292] {CVE-2026-89479} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254357] {CVE-2026-74588} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222954] {CVE-2026-52935} - powerpc/pseries: pci - logic bug (Mamatha Inamdar) [RHEL-240146] - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228} - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899] {CVE-2026-90036} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680] {CVE-2026-72262} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641} - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781] {CVE-2026-74583} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916] {CVE-2026-68377} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - [rt] build kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 [RHEL-53529] - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071} - [rt] build kernel-rt-4.18.0-553.21.1.rt7.362.el8_10 [RHEL-53529] - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874] - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558} - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441} - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904} - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322} - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246} - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008} - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228} - [rt] build kernel-rt-4.18.0-553.20.1.rt7.361.el8_10 [RHEL-53529] - KVM: arm64: Disassociate vcpus from redistributor region on teardown (Shaoqin Huang) [RHEL-48417] {CVE-2024-40989} - devres: Fix memory leakage caused by driver API devm_free_percpu() (CKI Backport Bot) [RHEL-55597] {CVE-2024-43871} - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (Izabela Bakollari) [RHEL-26680] {CVE-2024-26600} - nvmet-fc: avoid deadlock on delete association path (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - nvmet-fc: release reference on target port (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - ACPI: LPIT: Avoid u32 multiplication overflow (Mark Langsdorf) [RHEL-37062] {CVE-2023-52683} - sched/deadline: Fix task_struct reference leak (Phil Auld) [RHEL-50904] {CVE-2024-41023} - nfsd: fix crash on LOCKT on reexported NFSv3 (Benjamin Coddington) [RHEL-31515] - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path (CKI Backport Bot) [RHEL-26570] {CVE-2024-26595} - mlxsw: spectrum_acl_tcam: Move devlink param to TCAM code (Ivan Vecera) [RHEL-26570] {CVE-2024-26595} - ACPI: extlog: fix NULL pointer dereference check (Mark Langsdorf) [RHEL-29110] {CVE-2023-52605} - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() (Mark Langsdorf) [RHEL-33198] {CVE-2024-26894} - mm: prevent derefencing NULL ptr in pfn_section_valid() (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - mm, kmsan: fix infinite recursion due to RCU critical section (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - cipso: make cipso_v4_skbuff_delattr() fully remove the CIPSO options (Ondrej Mosnacek) [RHEL-30904] - cipso: fix total option length computation (Ondrej Mosnacek) [RHEL-30904] - ext4: do not create EA inode under buffer lock (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: check the return value of ext4_xattr_inode_dec_ref() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (Carlos Maiolino) [RHEL-48507] {CVE-2024-40998} - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - [rt] build kernel-rt-4.18.0-553.19.1.rt7.360.el8_10 [RHEL-53529] - drm/i915/vma: Fix UAF on destroy against retire race (Mika Penttilä) [RHEL-35222] {CVE-2024-26939} - RHEL-48620 (Kenneth Yin) [RHEL-48620] - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (CKI Backport Bot) [RHEL-42721] {CVE-2024-26855} - net: usb: asix: do not force pause frames support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix "can't send until first packet is send" issue (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix modprobe "sysfs: cannot create duplicate filename" (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: add proper error handling of usb read errors (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix wrong return value in asix_check_host_enable() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix uninit-value in asix_mdio_read() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: fix boolconv.cocci warnings (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: do not call phy_disconnect() for ax88178 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: move embedded PHY detection as early as possible (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix uninit value bugs (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add missing stop (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: suspend PHY on driver probe (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: manage PHY PM from MAC (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: add error handling for asix_mdio_* functions (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add phylib support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: refactor asix_read_phy_addr() and handle errors on return (Ken Cox) [RHEL-28108] {CVE-2021-47101} - SUNRPC: always free ctxt when freeing deferred request (Jay Shin) [RHEL-40936] - SUNRPC: double free xprt_ctxt while still in use (Jay Shin) [RHEL-40936] - SUNRPC: Remove svc_rqst::rq_xprt_hlen (Jay Shin) [RHEL-40936] - SUNRPC: Remove dead code in svc_tcp_release_rqst() (Jay Shin) [RHEL-40936] - x86/bugs: Extend VMware Retbleed workaround to Nehalem & earlier CPUs (Waiman Long) [RHEL-48646] - wifi: iwlwifi: read txq->read_ptr under lock (Jose Ignacio Tornos Martinez) [RHEL-39797] {CVE-2024-36922} - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (John Meneghini) [RHEL-39908] {CVE-2024-36919} - nbd: always initialize struct msghdr completely (Ming Lei) [RHEL-29498] {CVE-2024-26638} - block: don't call rq_qos_ops->done_bio if the bio isn't tracked (Ming Lei) [RHEL-42151] {CVE-2021-47412} - nvmet: fix a possible leak when destroy a ctrl during qp establishment (Maurizio Lombardi) [RHEL-52013] {CVE-2024-42152} - ipv6: prevent NULL dereference in ip6_output() (Sabrina Dubroca) [RHEL-39912] {CVE-2024-36901} - ppp: reject claimed-as-LCP but actually malformed packets (Guillaume Nault) [RHEL-51052] {CVE-2024-41044} - leds: trigger: Unregister sysfs attributes before calling deactivate() (CKI Backport Bot) [RHEL-54834] {CVE-2024-43830} - crypto: bcm - Fix pointer arithmetic (cki-backport-bot) [RHEL-44108] {CVE-2024-38579} - scsi: qedf: Ensure the copied buf is NUL terminated (John Meneghini) [RHEL-44195] {CVE-2024-38559} - x86/bhi: Avoid warning in #DB handler due to BHI mitigation (Waiman Long) [RHEL-53657] {CVE-2024-42240} - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (CKI Backport Bot) [RHEL-47529] {CVE-2024-40901} - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (CKI Backport Bot) [RHEL-39843] {CVE-2024-36902} - net: usb: ax88179_178a: improve link status logs (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: improve reset check (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: fix link status when link is set to down/up (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: avoid writing the mac address before first reading (Jose Ignacio Tornos Martinez) [RHEL-45167] - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - media: cec: cec-api: add locking in cec_release() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid confusing "transmit timed out" message (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid recursive cec_claim_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: remove length check of Timer Status (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: count low-drive, error and arb-lost conditions (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add note about *_from_edid() function usage in drm (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_unconfigured() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_nb_transmit_canceled() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: don't set last_initiator if tx in progress (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: disable adapter in cec_devnode_unregister (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: not all messages were passed on when monitoring (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add support for Absolute Volume Control (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: log when claiming LA fails unexpectedly (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: drop activate_cnt, use state info instead (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: reconfigure if the PA changes during configuration (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: fix is_configuring state (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: stop trying LAs on CEC_TX_STATUS_TIMEOUT (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't unconfigure if already unconfigured (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add optional adap_configured callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add xfer_timeout_ms field (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: use call_op and check for !unregistered (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix interrupt en/disable handling (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: drop unused 'enabled' field from struct cec_pin (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix off-by-one SFT check (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: rename timer overrun variables (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: correctly pass on reply results (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: abort if the current transmit was canceled (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: call enable_adap on s_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: media/cec.h: document cec_adapter fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix a deadlock situation (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: safely unhook lists in cec_data (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: copy sequence field for the reply (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix trivial style warnings (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: add 'unregistered' checks (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't use flush_scheduled_work() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: Use fallthrough pseudo-keyword (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: remove unused waitq and phys_addrs fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: silence shift wrapping warning in __cec_s_log_addrs() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: move the core to a separate directory (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - net/iucv: Avoid explicit cpumask var allocation on stack (CKI Backport Bot) [RHEL-51631] {CVE-2024-42094} - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (Dick Kennedy) [RHEL-40400] - KVM: selftests: Make hyperv_clock require TSC based system clocksource (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Run clocksource dependent tests with hyperv_clocksource_tsc_page too (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Use generic sys_clocksource_is_tsc() in vmx_nested_tsc_scaling_test (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Generalize check_clocksource() from kvm_clock_test (Vitaly Kuznetsov) [RHEL-19027] - firmware: cs_dsp: Return error if block header overflows file (CKI Backport Bot) [RHEL-53646] {CVE-2024-42238} - firmware: cs_dsp: Validate payload length before processing block (CKI Backport Bot) [RHEL-53638] {CVE-2024-42237} - mm, slub: fix potential memoryleak in kmem_cache_open() (Waiman Long) [RHEL-38404] {CVE-2021-47466} - slub: don't panic for memcg kmem cache creation failure (Waiman Long) [RHEL-38404] {CVE-2021-47466} - wifi: ath11k: fix htt pktlog locking (Jose Ignacio Tornos Martinez) [RHEL-38317] {CVE-2023-52800} - wifi: ath11k: fix dfs radar event locking (Jose Ignacio Tornos Martinez) [RHEL-38165] {CVE-2023-52798} - lib/generic-radix-tree.c: Don't overflow in peek() (Waiman Long) [RHEL-37737] {CVE-2021-47432} - include/linux/generic-radix-tree.h: replace kernel.h with the necessary inclusions (Waiman Long) [RHEL-37737] {CVE-2021-47432} - EDAC/i10nm: Skip the absent memory controllers (Aristeu Rozanski) [RHEL-43236] - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (John Meneghini) [RHEL-38197] {CVE-2023-52809} - gfs2: Fix potential glock use-after-free on unmount (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: simplify gdlm_put_lock with out_free label (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: Remove ill-placed consistency check (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - nvme-fc: do not wait in vain when unloading module (Ewan D. Milne) [RHEL-33083] {CVE-2024-26846} - HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts (CKI Backport Bot) [RHEL-49698] {CVE-2022-48866} - scsi: qedf: Set qed_slowpath_params to zero before use (John Meneghini) [RHEL-9797] - scsi: qedf: Wait for stag work during unload (John Meneghini) [RHEL-9797] - scsi: qedf: Don't process stag work during unload and recovery (John Meneghini) [RHEL-9797] - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - mm: avoid overflows in dirty throttling logic (Audra Mitchell) [RHEL-51840] {CVE-2024-42131} - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - ACPI: fix NULL pointer dereference (Mark Langsdorf) [RHEL-37897] {CVE-2021-47289} - [rt] build kernel-rt-4.18.0-553.18.1.rt7.359.el8_10 [RHEL-53529] - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING (Ewan D. Milne) [RHEL-39805] {CVE-2024-36920} - tun: limit printing rate when illegal packet received by tun dev (Jon Maloy) [RHEL-35046] {CVE-2024-27013} - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu/mes: fix use-after-free issue (Michel Dänzer) [RHEL-44043] {CVE-2024-38581} - drm/amdgpu: Fix the null pointer when load rlc firmware (Michel Dänzer) [RHEL-30603] {CVE-2024-26649} - drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (Michel Dänzer) [RHEL-35160] {CVE-2024-27042} - net/sched: Fix UAF when resolving a clash (Xin Long) [RHEL-51014] {CVE-2024-41040} - tcp_metrics: validate source addr length (Guillaume Nault) [RHEL-52025] {CVE-2024-42154} - NFSv4/pnfs: Fix a use-after-free bug in open (Benjamin Coddington) [RHEL-35508] - NFSv4: Don't hold the layoutget locks across multiple RPC calls (Benjamin Coddington) [RHEL-35508] - scsi: qedf: Make qedf_execute_tmf() non-preemptible (John Meneghini) [RHEL-51799] {CVE-2024-42124} - Input: elantech - fix stack out of bound access in elantech_change_report_id() (CKI Backport Bot) [RHEL-41938] {CVE-2021-47097} - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (CKI Backport Bot) [RHEL-28982] {CVE-2023-52478} - drm/radeon: fix UBSAN warning in kv_dpm.c (CKI Backport Bot) [RHEL-48399] {CVE-2024-40988} - usb: core: Don't hold the device lock while sleeping in do_proc_control() (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - USB: core: Make do_proc_control() and do_proc_bulk() killable (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - scsi: qedi: Fix crash while reading debugfs attribute (CKI Backport Bot) [RHEL-48327] {CVE-2024-40978} - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CKI Backport Bot) [RHEL-48309] {CVE-2024-40977} - net: tcp: accept old ack during closing (Jamie Bainbridge) [RHEL-52433] - wifi: iwlwifi: mvm: don't read past the mfuart notifcation (CKI Backport Bot) [RHEL-48016] {CVE-2024-40941} - net/iucv: fix use after free in iucv_sock_close() (Mete Durlu) [RHEL-53988] - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (CKI Backport Bot) [RHEL-47908] {CVE-2024-40929} - Input: aiptek - properly check endpoint type (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - use descriptors of current altsetting (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - fix endpoint sanity check (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB (CKI Backport Bot) [RHEL-52373] {CVE-2024-42226} - wifi: mt76: replace skb_put with skb_put_zero (CKI Backport Bot) [RHEL-52366] {CVE-2024-42225} - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (CKI Backport Bot) [RHEL-47776] {CVE-2024-40912} - wifi: cfg80211: Lock wiphy in cfg80211_get_station (CKI Backport Bot) [RHEL-47758] {CVE-2024-40911} - VMCI: Use struct_size() in kmalloc() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() (Steve Best) [RHEL-37325] {CVE-2024-35944} - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values (Jose Ignacio Tornos Martinez) [RHEL-51761] {CVE-2024-42114} - usb: atm: cxacru: fix endpoint checking in cxacru_bind() (CKI Backport Bot) [RHEL-51442] {CVE-2024-41097} - nfs: handle error of rpc_proc_register() in init_nfs_fs() (Scott Mayhew) [RHEL-39904] {CVE-2024-36939} - drm/radeon: check bo_va->bo is non-NULL before using it (CKI Backport Bot) [RHEL-51184] {CVE-2024-41060} - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). (CKI Backport Bot) [RHEL-51027] {CVE-2024-41041} - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (CKI Backport Bot) [RHEL-50961] {CVE-2024-41035} - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). (CKI Backport Bot) [RHEL-44408] {CVE-2024-37356} - tcp: avoid too many retransmit packets (Florian Westphal) [RHEL-48627] {CVE-2024-41007} - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() (Florian Westphal) [RHEL-48627] - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Florian Westphal) [RHEL-48627] - tcp: refactor tcp_retransmit_timer() (Florian Westphal) [RHEL-48627] - tcp: exit if nothing to retransmit on RTO timeout (Florian Westphal) [RHEL-48627] - netfilter: nf_tables: Reject tables of unsupported family (Florian Westphal) [RHEL-21418] {CVE-2023-6040} - [rt] build kernel-rt-4.18.0-553.17.1.rt7.358.el8_10 [RHEL-53529] - kyber: fix out of bounds access when preempted (Ming Lei) [RHEL-27258] {CVE-2021-46984} - vfs: don't mod negative dentry count when on shrinker list (Brian Foster) [RHEL-35874] - fs/dcache: Re-use value stored to dentry->d_flags instead of re-reading (Brian Foster) [RHEL-35874] - fbmem: Do not delete the mode that is still in use (CKI Backport Bot) [RHEL-37796] {CVE-2021-47338} - netpoll: Fix race condition in netpoll_owner_active (CKI Backport Bot) [RHEL-49361] {CVE-2024-41005} - firmware: arm_scpi: Fix string overflow in SCPI genpd driver (Mark Salter) [RHEL-43702] {CVE-2021-47609} - ipv6: prevent possible NULL dereference in rt6_probe() (Guillaume Nault) [RHEL-48149] {CVE-2024-40960} - HID: i2c-hid-of: fix NULL-deref on failed power up (CKI Backport Bot) [RHEL-31598] {CVE-2024-26717} - cpufreq: amd-pstate: fix memory leak on CPU EPP exit (CKI Backport Bot) [RHEL-48489] {CVE-2024-40997} - x86/mm/pat: fix VM_PAT handling in COW mappings (Chris von Recklinghausen) [RHEL-37258] {CVE-2024-35877} - PCI/PM: Drain runtime-idle callbacks before driver removal (Myron Stowe) [RHEL-42937] {CVE-2024-35809} - PCI: Drop pci_device_remove() test of pci_dev->driver (Myron Stowe) [RHEL-42937] {CVE-2024-35809} - drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() (Mika Penttilä) [RHEL-26909] {CVE-2023-52470} - USB: core: Fix hang in usb_kill_urb by adding memory barriers (Desnes Nunes) [RHEL-43979] {CVE-2022-48760} - cifs: fix bad fids sent over wire (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB311_posix_mkdir (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB2_tcon (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB2_open (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB2_ioctl (Paulo Alcantara) [RHEL-52517] - selftests: forwarding: devlink_lib: Wait for udev events after reloading (Mark Langsdorf) [RHEL-47642] {CVE-2024-39501} - drivers: core: synchronize really_probe() and dev_uevent() (Mark Langsdorf) [RHEL-47642] {CVE-2024-39501} - udp: do not accept non-tunnel GSO skbs landing in a tunnel (Xin Long) [RHEL-42997] {CVE-2024-35884} - filelock: Remove locks reliably when fcntl/close race is detected (Bill O'Donnell) [RHEL-50170] {CVE-2024-41012} - Input: add bounds checking to input_set_capability() (Benjamin Tissoires) [RHEL-21413] {CVE-2022-48619} - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() (CKI Backport Bot) [RHEL-48130] {CVE-2024-40959} - blk-cgroup: fix list corruption from reorder of WRITE ->lqueued (Ming Lei) [RHEL-33695] - blk-cgroup: fix list corruption from resetting io stat (Ming Lei) [RHEL-33695] - net: do not leave a dangling sk pointer, when socket creation fails (CKI Backport Bot) [RHEL-48060] {CVE-2024-40954} - perf/x86/lbr: Filter vsyscall addresses (Michael Petlan) [RHEL-28991] {CVE-2023-52476} - vmci: prevent speculation leaks by sanitizing event in event_deliver() (CKI Backport Bot) [RHEL-47678] {CVE-2024-39499} - serial: core: fix transmit-buffer reset and memleak (Steve Best) [RHEL-38731] {CVE-2021-47527} - powerpc/pseries: Whitelist dtl slub object for copying to userspace (Mamatha Inamdar) [RHEL-51236] {CVE-2024-41065} - powerpc/eeh: avoid possible crash when edev->pdev changes (Mamatha Inamdar) [RHEL-51220] {CVE-2024-41064} - x86: stop playing stack games in profile_pc() (Steve Best) [RHEL-51643] {CVE-2024-42096} - mptcp: ensure snd_una is properly initialized on connect (Florian Westphal) [RHEL-47933 RHEL-47934] {CVE-2024-40931} - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet (CKI Backport Bot) [RHEL-47492] {CVE-2024-39506} - tun: add missing verification for short frame (Patrick Talbert) [RHEL-50194] {CVE-2024-41091} - tap: add missing verification for short frame (Patrick Talbert) [RHEL-50279] {CVE-2024-41090} - usb-storage: alauda: Check whether the media is initialized (Desnes Nunes) [RHEL-43708] {CVE-2024-38619} - usb-storage: alauda: Fix uninit-value in alauda_check_media() (Desnes Nunes) [RHEL-43708] {CVE-2024-38619} - hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37723] {CVE-2021-47384} - block: fix that util can be greater than 100% (Ming Lei) [RHEL-23074] - block: support to account io_ticks precisely (Ming Lei) [RHEL-23074] - watchdog: Fix possible use-after-free by calling del_timer_sync() (Steve Best) [RHEL-38795] {CVE-2021-47321} - hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37719] {CVE-2021-47385} - mlxsw: spectrum: Protect driver from buggy firmware (CKI Backport Bot) [RHEL-42245] {CVE-2021-47560} - mlxsw: Verify the accessed index doesn't exceed the array length (CKI Backport Bot) [RHEL-42245] {CVE-2021-47560} - dm: call the resume method on internal suspend (Benjamin Marzinski) [RHEL-41835] {CVE-2024-26880} - tty: Fix out-of-bound vmalloc access in imageblit (Steve Best) [RHEL-37727] {CVE-2021-47383} - hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37715] {CVE-2021-47386} - hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs (Steve Best) [RHEL-37710] {CVE-2021-47393} - nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells (Steve Best) [RHEL-38436] {CVE-2021-47497} - driver core: auxiliary bus: Fix memory leak when driver_register() fail (Steve Best) [RHEL-37901] {CVE-2021-47287} - phylib: fix potential use-after-free (cki-backport-bot) [RHEL-43764] {CVE-2022-48754} - ptp: Fix possible memory leak in ptp_clock_register() (Hangbin Liu) [RHEL-38424] {CVE-2021-47455} - NFSv4: Fix memory leak in nfs4_set_security_label (CKI Backport Bot) [RHEL-51315] {CVE-2024-41076} - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER (CKI Backport Bot) [RHEL-51618] {CVE-2024-42090} - ftruncate: pass a signed offset (CKI Backport Bot) [RHEL-51598] {CVE-2024-42084} - af_unix: Fix garbage collector racing against connect() (Felix Maurer) [RHEL-34225] {CVE-2024-26923} - virtio-net: Add validation for used length (Laurent Vivier) [RHEL-42080] {CVE-2021-47352} - net: fix possible store tearing in neigh_periodic_work() (Antoine Tenart) [RHEL-42359] {CVE-2023-52522} - tunnels: fix out of bounds access when building IPv6 PMTU error (Antoine Tenart) [RHEL-41823] {CVE-2024-26665} - vt_ioctl: fix array_index_nospec in vt_setactivate (John W. Linville) [RHEL-49141] {CVE-2022-48804} - Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() (CKI Backport Bot) [RHEL-38302] {CVE-2023-52840} - netns: Make get_net_ns() handle zero refcount net (Antoine Tenart) [RHEL-48105] {CVE-2024-40958} - tracing: Ensure visibility when inserting an element into tracing_map (Michael Petlan) [RHEL-30457] {CVE-2024-26645} - KVM: s390: fix LPSWEY handling (CKI Backport Bot) [RHEL-50072] - firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files (CKI Backport Bot) [RHEL-51144] {CVE-2024-41056} - SUNRPC: Fix a race to wake a sync task (Benjamin Coddington) [RHEL-11843] - firmware: cs_dsp: Fix overflow checking of wmfw header (CKI Backport Bot) [RHEL-50999] {CVE-2024-41039} - firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers (CKI Backport Bot) [RHEL-50987] {CVE-2024-41038} - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (Xin Long) [RHEL-48471] {CVE-2024-40995} - net: fix out-of-bounds access in ops_init (Xin Long) [RHEL-43185] {CVE-2024-36883} - x86/mce/therm_throt: Undo thermal polling properly on CPU offline (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Do not access uninitialized therm_work (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Mark throttle_active_work() as __maybe_unused (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Mask out read-only and reserved MSR bits (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Optimize notifications of thermal throttle (Steve Best) [RHEL-45310] - jiffies: add utility function to calculate delta in ms (Steve Best) [RHEL-45310] - x86/mce: Lower throttling MCE messages' priority to warning (Steve Best) [RHEL-45310] - dmaengine: idxd: Fix oops during rmmod on single-CPU platforms (Eder Zulian) [RHEL-37361] {CVE-2024-35989} - xfs: don't walk off the end of a directory data block (CKI Backport Bot) [RHEL-50879] {CVE-2024-41013} - xfs: add bounds checking to xlog_recover_process_data (CKI Backport Bot) [RHEL-50856] {CVE-2024-41014} - dm-crypt: limit the size of encryption requests (Benjamin Marzinski) [RHEL-29330] - netfilter: flowtable: remove nf_ct_l4proto_find() call (Florian Westphal) [RHEL-49589] - [rt] build kernel-rt-4.18.0-553.16.1.rt7.357.el8_10 [RHEL-44553] - x86/bhi: Fix incorrect CLEAR_BRANCH_HISTORY position in entry_INT80_compat (Waiman Long) [RHEL-50648] - [rt] build kernel-rt-4.18.0-553.15.1.rt7.356.el8_10 [RHEL-44553] - Revert "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-44613] - ionic: fix use after netif_napi_del() (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - ionic: clean interrupt before enabling queue to avoid credit race (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change (CKI Backport Bot) [RHEL-49321] {CVE-2021-47624} - xhci: Handle TD clearing for multiple streams case (CKI Backport Bot) [RHEL-47882] {CVE-2024-40927} - net: openvswitch: Fix Use-After-Free in ovs_ct_exit (cki-backport-bot) [RHEL-36362] {CVE-2024-27395} - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: fix vlan use-after-free (cki-backport-bot) [RHEL-43721] {CVE-2024-36979} - irqchip/gic-v3-its: Prevent double free on error (Charles Mirabile) [RHEL-37022] {CVE-2024-35847} - irqchip/gic-v3-its: Fix potential VPE leak on error (Charles Mirabile) [RHEL-37744] {CVE-2021-47373} - i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() (Charles Mirabile) [RHEL-34735] {CVE-2022-48632} - iommu/dma: fix zeroing of bounce buffer padding used by untrusted devices (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: remove alloc_size argument to swiotlb_tbl_map_single() (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: fix swiotlb_bounce() to do partial sync's correctly (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Reinstate page-alignment for mappings >= PAGE_SIZE (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix alignment checks when both allocation and DMA masks are present (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix double-allocation of slots due to broken alignment handling (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (cki-backport-bot) [RHEL-44441] {CVE-2024-31076} - [rt] build kernel-rt-4.18.0-553.14.1.rt7.355.el8_10 [RHEL-44553] - s390/qeth: Fix kernel panic after setting hsuid (Mete Durlu) [RHEL-49754] - perf/core: Protect event sibling list locking against interrupt inversion (Daniel Vacek) [RHEL-31798] - vt: fix unicode buffer corruption when deleting characters (Steve Best) [RHEL-36936] {CVE-2024-35823} - cifs: translate network errors on send to -ECONNABORTED (Paulo Alcantara) [RHEL-36754] - xfs: don't block in busy flushing when freeing extents (Brian Foster) [RHEL-7984] - xfs: allow extent free intents to be retried (Brian Foster) [RHEL-7984] - xfs: pass alloc flags through to xfs_extent_busy_flush() (Brian Foster) [RHEL-7984] - xfs: use deferred frees for btree block freeing (Brian Foster) [RHEL-7984] - xfs: fix bounds check in xfs_defer_agfl_block() (Brian Foster) [RHEL-7984] - xfs: validate block number being freed before adding to xefi (Brian Foster) [RHEL-7984] - xfs: rename xfs_bmap_add_free to xfs_free_extent_later (Brian Foster) [RHEL-7984] - usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (Desnes Nunes) [RHEL-36803] {CVE-2024-35790} - stm class: Fix a double free in stm_register_device() (Steve Best) [RHEL-44514] {CVE-2024-38627} - s390/qeth: Fix potential loss of L3-IP@ in case of network issues (Mete Durlu) [RHEL-49755] - tls: fix missing memory barrier in tls_init (cki-backport-bot) [RHEL-44471] {CVE-2024-36489} - xfs: fix log recovery buffer allocation for the legacy h_size fixup (Bill O'Donnell) [RHEL-46473] {CVE-2024-39472} - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: use __for_each_thread() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - exit: Use the correct exit_code in /proc/<pid>/stat (Brian Foster) [RHEL-31562] {CVE-2024-26686} - scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool (Ewan D. Milne) [RHEL-38283] {CVE-2023-52811} - scsi: qla2xxx: Fix double free of fcport (Ewan D. Milne) [RHEL-39549] {CVE-2024-26929} - scsi: qla2xxx: Fix double free of the ha->vp_map pointer (Ewan D. Milne) [RHEL-39549] {CVE-2024-26930} - scsi: qla2xxx: Fix command flush on cable pull (Ewan D. Milne) [RHEL-39549] {CVE-2024-26931} - [rt] build kernel-rt-4.18.0-553.13.1.rt7.354.el8_10 [RHEL-44553] - redhat: remove handling of deleted rhdocs/ directory from genspec.sh (Denys Vlasenko) - x86/bugs: Fix BHI retpoline check (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI handling of RRSBA (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr' (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI documentation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix return type of spectre_bhi_state() (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Make CONFIG_SPECTRE_BHI_ON the default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Mitigate KVM by default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add BHI mitigation knob (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Enumerate Branch History Injection (BHI) bug (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Define SPEC_CTRL_BHI_DIS_S (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add support for clearing branch history at syscall entry (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file (Waiman Long) [RHEL-28202] - perf/x86/amd/lbr: Use freeze based on availability (Waiman Long) [RHEL-28202] - Documentation/kernel-parameters: Add spec_rstack_overflow to mitigations=off (Waiman Long) [RHEL-28202] - KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace (Waiman Long) [RHEL-28202] - x86/bugs: Reset speculation control settings on init (Waiman Long) [RHEL-28202] - KVM: x86: Update KVM-only leaf handling to allow for 100% KVM-only leafs (Waiman Long) [RHEL-28202] - KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest (Waiman Long) [RHEL-28202] - mptcp: ensure snd_nxt is properly initialized on connect (Davide Caratti) [RHEL-39865] {CVE-2024-36889} - powerpc/pseries: Enforce hcall result buffer validity and size (Mamatha Inamdar) [RHEL-48291] {CVE-2024-40974} - wifi: mac80211: fix potential key use-after-free (Jose Ignacio Tornos Martinez) [RHEL-28007] {CVE-2023-52530} - cppc_cpufreq: Fix possible null pointer dereference (Mark Langsdorf) [RHEL-44137] {CVE-2024-38573} - net/sched: act_mirred: use the backlog for mirred ingress (Davide Caratti) [RHEL-31718] {CVE-2024-26740} - vfio/pci: Lock external INTx masking ops (Alex Williamson) [RHEL-31922] {CVE-2024-26810} - net: sched: sch_multiq: fix possible OOB write in multiq_tune() (Davide Caratti) [RHEL-43464] {CVE-2024-36978} - tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized (Guillaume Nault) [RHEL-37850] {CVE-2021-47304} - pstore/ram: Fix crash when setting number of cpus to an odd number (Lenny Szubowicz) [RHEL-29471] {CVE-2023-52619} - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node (Jocelyn Falempe) [RHEL-37101] {CVE-2023-52662} - drm/vmwgfx: Fix the lifetime of the bo cursor memory (Jocelyn Falempe) [RHEL-36962] {CVE-2024-35810} - drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed (Jocelyn Falempe) [RHEL-34987] {CVE-2024-26940} - drm/vmwgfx: Unmap the surface before resetting it on a plane state (Jocelyn Falempe) [RHEL-35217] {CVE-2023-52648} - drm/vmwgfx: Fix invalid reads in fence signaled events (Jocelyn Falempe) [RHEL-40010] {CVE-2024-36960} - block: Fix wrong offset in bio_truncate() (Ming Lei) [RHEL-43782] {CVE-2022-48747} - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CKI Backport Bot) [RHEL-46913] {CVE-2024-39487} - net: fix __dst_negative_advice() race (Xin Long) [RHEL-41183] {CVE-2024-36971} - igc: avoid returning frame twice in XDP_REDIRECT (Corinna Vinschen) [RHEL-33264] {CVE-2024-26853} - mac802154: fix llsec key resources release in mac802154_llsec_key_del (Steve Best) [RHEL-34967] {CVE-2024-26961} - cpufreq: exit() callback is optional (Mark Langsdorf) [RHEL-43840] {CVE-2024-38615} - cifs: prevent infinite recursion in CIFSGetDFSRefer() (Paulo Alcantara) [RHEL-34672] - cifs: lock chan_lock outside match_session (Paulo Alcantara) [RHEL-34672] - smb3: workaround negprot bug in some Samba servers (Paulo Alcantara) [RHEL-34672] - smb3: use netname when available on secondary channels (Paulo Alcantara) [RHEL-34672] - smb3: fix empty netname context on secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: populate empty hostnames for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: always iterate smb sessions using primary channel (Paulo Alcantara) [RHEL-34672] - cifs: Fix connections leak when tlink setup failed (Paulo Alcantara) [RHEL-34672] - cifs: Fix memory leak when build ntlmssp negotiate blob failed (Paulo Alcantara) [RHEL-34672] - cifs: always initialize struct msghdr smb_msg completely (Paulo Alcantara) [RHEL-34672] - cifs: don't send down the destination address to sendmsg for a SOCK_STREAM (Paulo Alcantara) [RHEL-34672] - cifs: revalidate mapping when doing direct writes (Paulo Alcantara) [RHEL-34672] - cifs: skip extra NULL byte in filenames (Paulo Alcantara) [RHEL-34672] - cifs: list_for_each() -> list_for_each_entry() (Paulo Alcantara) [RHEL-34672] - smb2: small refactor in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - cifs: Fix crash on unload of cifs_arc4.ko (Paulo Alcantara) [RHEL-34672] - cifs: remove check of list iterator against head past the loop body (Paulo Alcantara) [RHEL-34672] - cifs: fix reconnect on smb3 mount types (Paulo Alcantara) [RHEL-34672] - cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (Paulo Alcantara) [RHEL-34672] - cifs: skip trailing separators of prefix paths (Paulo Alcantara) [RHEL-34672] - cifs: fix ntlmssp on old servers (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL ptr dereference in refresh_mounts() (Paulo Alcantara) [RHEL-34672] - cifs: do not skip link targets when an I/O fails (Paulo Alcantara) [RHEL-34672] - cifs: fix confusing unneeded warning message on smb2.1 and earlier (Paulo Alcantara) [RHEL-34672] - smb3: fix snapshot mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix workstation_name for multiuser mounts (Paulo Alcantara) [RHEL-34672] - cifs: alloc_path_with_tree_prefix: do not append sep. if the path is empty (Paulo Alcantara) [RHEL-34672] - cifs: free ntlmsspblob allocated in negotiate (Paulo Alcantara) [RHEL-34672] - cifs: avoid use of dstaddr as key for fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: add server conn_id to fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: fix missed refcounting of ipc tcon (Paulo Alcantara) [RHEL-34672] - smb2: clarify rc initialization in smb2_reconnect (Paulo Alcantara) [RHEL-34672] - cifs: populate server_hostname for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should be set on new server (Paulo Alcantara) [RHEL-34672] - cifs: introduce cifs_ses_mark_for_reconnect() helper (Paulo Alcantara) [RHEL-34672] - cifs: protect srv_count with cifs_tcp_ses_lock (Paulo Alcantara) [RHEL-34672] - cifs: move debug print out of spinlock (Paulo Alcantara) [RHEL-34672] - cifs: do not duplicate fscache cookie for secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: connect individual channel servers to primary channel server (Paulo Alcantara) [RHEL-34672] - cifs: protect session channel fields with chan_lock (Paulo Alcantara) [RHEL-34672] - cifs: do not negotiate session if session already exists (Paulo Alcantara) [RHEL-34672] - smb3: do not setup the fscache_super_cookie until fsinfo initialized (Paulo Alcantara) [RHEL-34672] - cifs: fix potential use-after-free bugs (Paulo Alcantara) [RHEL-34672] - cifs: release lock earlier in dequeue_mid error case (Paulo Alcantara) [RHEL-34672] - smb3: remove trivial dfs compile warning (Paulo Alcantara) [RHEL-34672] - cifs: support nested dfs links over reconnect (Paulo Alcantara) [RHEL-34672] - cifs: for compound requests, use open handle if possible (Paulo Alcantara) [RHEL-34672] - cifs: split out dfs code from cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant (Paulo Alcantara) [RHEL-34672] - cifs: introduce new helper for cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: fix print of hdr_flags in dfscache_proc_show() (Paulo Alcantara) [RHEL-34672] - cifs: send workstation name during ntlmssp session setup (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should not share socket with future sessions (Paulo Alcantara) [RHEL-34672] - smb3: add dynamic trace points for socket connection (Paulo Alcantara) [RHEL-34672] - cifs: Move SMB2_Create definitions to the shared area (Paulo Alcantara) [RHEL-34672] - cifs: Move more definitions into the shared area (Paulo Alcantara) [RHEL-34672] - cifs: move NEGOTIATE_PROTOCOL definitions out into the common area (Paulo Alcantara) [RHEL-34672] - cifs: Create a new shared file holding smb2 pdu definitions (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect check for null pointer in header_assemble (Paulo Alcantara) [RHEL-34672] - smb3: correct server pointer dereferencing check to be more consistent (Paulo Alcantara) [RHEL-34672] - cifs: Deal with some warnings from W=1 (Paulo Alcantara) [RHEL-34672] - cifs: fix a sign extension bug (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect kernel doc comments (Paulo Alcantara) [RHEL-34672] - cifs: remove pathname for file from SPDX header (Paulo Alcantara) [RHEL-34672] - cifs: move SMB FSCTL definitions to common code (Paulo Alcantara) [RHEL-34672] - cifs: rename cifs_common to smbfs_common (Paulo Alcantara) [RHEL-34672] - cifs: update FSCTL definitions (Paulo Alcantara) [RHEL-34672] - cifs: cifs_md4 convert to SPDX identifier (Paulo Alcantara) [RHEL-34672] - cifs: create a MD4 module and switch cifs.ko to use it (Paulo Alcantara) [RHEL-34672] - cifs: fork arc4 and create a separate module for it for cifs and other users (Paulo Alcantara) [RHEL-34672] - smb3: fix posix extensions mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix wrong release in sess_alloc_buffer() failed path (Paulo Alcantara) [RHEL-34672] - CIFS: Fix a potencially linear read overflow (Paulo Alcantara) [RHEL-34672] - cifs: use the correct max-length for dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: create sd context must be a multiple of 8 (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp sessions of dfs connections (Paulo Alcantara) [RHEL-34672] - cifs: added WARN_ON for all the count decrements (Paulo Alcantara) [RHEL-34672] - cifs: fix missing null session check in mount (Paulo Alcantara) [RHEL-34672] - cifs: handle reconnect of tcon when there is no cached dfs referral (Paulo Alcantara) [RHEL-34672] - cifs: fix the out of range assignment to bit fields in parse_server_interfaces (Paulo Alcantara) [RHEL-34672] - smb3: fix typo in header file (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: Add support for negotiating signing algorithm (Paulo Alcantara) [RHEL-34672] - cifs: prevent NULL deref in cifs_compose_mount_options() (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL dereference in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - smbdirect: missing rc checks while waiting for rdma events (Paulo Alcantara) [RHEL-34672] - cifs: Avoid field over-reading memcpy() (Paulo Alcantara) [RHEL-34672] - smb311: remove dead code for non compounded posix query info (Paulo Alcantara) [RHEL-34672] - cifs: fix SMB1 error path in cifs_get_file_info_unix (Paulo Alcantara) [RHEL-34672] - smb3: fix uninitialized value for port in witness protocol move (Paulo Alcantara) [RHEL-34672] - cifs: fix unneeded null check (Paulo Alcantara) [RHEL-34672] - cifs: use SPDX-Licence-Identifier (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in cifs_debug.c (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in smb2misc.c (Paulo Alcantara) [RHEL-34672] - cifs: missed ref-counting smb session in find (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp servers with dfs mounts (Paulo Alcantara) [RHEL-34672] - cifs: set a minimum of 2 minutes for refreshing dfs cache (Paulo Alcantara) [RHEL-34672] - cifs: Remove unused inline function is_sysvol_or_netlogon() (Paulo Alcantara) [RHEL-34672] - cifs: remove duplicated prototype (Paulo Alcantara) [RHEL-34672] - cifs: fix ipv6 formating in cifs_ses_add_channel (Paulo Alcantara) [RHEL-34672] - cifs: fix string declarations and assignments in tracepoints (Paulo Alcantara) [RHEL-34672] - cifs: fix memory leak in smb2_copychunk_range (Paulo Alcantara) [RHEL-34672] - SMB3: incorrect file id in requests compounded with open (Paulo Alcantara) [RHEL-34672] - smb3: if max_channels set to more than one channel request multichannel (Paulo Alcantara) [RHEL-34672] - smb3: do not attempt multichannel to server which does not support it (Paulo Alcantara) [RHEL-34672] - smb3: when mounting with multichannel include it in requested capabilities (Paulo Alcantara) [RHEL-34672] - cifs: simplify SWN code with dummy funcs instead of ifdefs (Paulo Alcantara) [RHEL-34672] - cifs: log mount errors using cifs_errorf() (Paulo Alcantara) [RHEL-34672] - cifs: switch build_path_from_dentry() to using dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: fix out-of-bound memory access when calling smb3_notify() at mount point (Paulo Alcantara) [RHEL-34672] - cifs: allocate buffer in the caller of build_path_from_dentry() (Paulo Alcantara) [RHEL-34672] - cifs: make build_path_from_dentry() return const char * (Paulo Alcantara) [RHEL-34672] - cifs: remove old dead code (Paulo Alcantara) [RHEL-34672] - fs: cifs: Remove repeated struct declaration (Paulo Alcantara) [RHEL-34672] - cifs: have cifs_fattr_to_inode() refuse to change type on live inode (Paulo Alcantara) [RHEL-34672] - cifs: have ->mkdir() handle race with another client sanely (Paulo Alcantara) [RHEL-34672] - do_cifs_create(): don't set ->i_mode of something we had not created (Paulo Alcantara) [RHEL-34672] - cifs: Silently ignore unknown oplock break handle (Paulo Alcantara) [RHEL-34672] - cifs: change noisy error message to FYI (Paulo Alcantara) [RHEL-34672] - cifs: print MIDs in decimal notation (Paulo Alcantara) [RHEL-34672] - cifs: minor simplification to smb2_is_network_name_deleted (Paulo Alcantara) [RHEL-34672] - TCON Reconnect during STATUS_NETWORK_NAME_DELETED (Paulo Alcantara) [RHEL-34672] - cifs: clarify hostname vs ip address in /proc/fs/cifs/DebugData (Paulo Alcantara) [RHEL-34672] - cifs: change confusing field serverName (to ip_addr) (Paulo Alcantara) [RHEL-34672] - cifs: Reformat DebugData and index connections by conn_id. (Paulo Alcantara) [RHEL-34672] - cifs: Identify a connection by a conn_id. (Paulo Alcantara) [RHEL-34672] - smb3: negotiate current dialect (SMB3.1.1) when version 3 or greater requested (Paulo Alcantara) [RHEL-34672] - smb3: Fix out-of-bounds bug in SMB2_negotiate() (Paulo Alcantara) [RHEL-34672] - fs/cifs: Simplify bool comparison. (Paulo Alcantara) [RHEL-34672] - fs/cifs: Assign boolean values to a bool variable (Paulo Alcantara) [RHEL-34672] - cifs: Avoid error pointer dereference (Paulo Alcantara) [RHEL-34672] - cifs: Re-indent cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Unlock on errors in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Delete a stray unlock in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Tracepoints and logs for tracing credit changes. (Paulo Alcantara) [RHEL-34672] - cifs: Fix some error pointers handling detected by static checker (Paulo Alcantara) [RHEL-34672] - smb3: remind users that witness protocol is experimental (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: do not log warning message if server doesn't populate salt (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: update comments clarifying SPNEGO info in negprot response (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot rsp (Paulo Alcantara) [RHEL-34672] - SMB3: avoid confusing warning message on mount to Azure (Paulo Alcantara) [RHEL-34672] - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (Nigel Croxon) [RHEL-46662] {CVE-2024-39476} - net: fix information leakage in /proc/net/ptype (Hangbin Liu) [RHEL-44000] {CVE-2022-48757} - usb: typec: ucsi: Limit read size on v1.2 (Desnes Nunes) [RHEL-37286] {CVE-2024-35924} - minmax: relax check to allow comparison between unsigned arguments and signed constants (Desnes Nunes) [RHEL-37286] - minmax: allow comparisons of 'int' against 'unsigned char/short' (Desnes Nunes) [RHEL-37286] - minmax: allow min()/max()/clamp() if the arguments have the same signedness. (Desnes Nunes) [RHEL-37286] - minmax: add umin(a, b) and umax(a, b) (Desnes Nunes) [RHEL-37286] - minmax: fix header inclusions (Desnes Nunes) [RHEL-37286] - minmax: clamp more efficiently by avoiding extra comparison (Desnes Nunes) [RHEL-37286] - minmax: sanity check constant bounds when clamping (Desnes Nunes) [RHEL-37286] - tracing: Define the is_signed_type() macro once (Desnes Nunes) [RHEL-37286] - linux/bits.h: fix compilation error with GENMASK (Desnes Nunes) [RHEL-37286] - x86/apic: Mask IOAPIC entries when disabling the local APIC (Lenny Szubowicz) [RHEL-18077] - userfaultfd: fix a race between writeprotect and exit_mmap() (Rafael Aquini) [RHEL-38410] {CVE-2021-47461} - mm: khugepaged: skip huge page collapse for special files (Waiman Long) [RHEL-38446] {CVE-2021-47491} - cachefiles: fix memory leak in cachefiles_add_cache() (Andrey Albershteyn) [RHEL-33109] {CVE-2024-26840} - drm/amd/display: Implement bounds check for stream encoder creation in DCN301 (Michel Dänzer) [RHEL-31429] {CVE-2024-26660} - net/mlx5: Discard command completions in internal error (Kamal Heib) [RHEL-44231] {CVE-2024-38555} - drm: Don't unref the same fb many times by mistake due to deadlock handling (CKI Backport Bot) [RHEL-29011] {CVE-2023-52486} - md: fix resync softlockup when bitmap size is less than array size (Nigel Croxon) [RHEL-43942] {CVE-2024-38598} - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation (Davide Caratti) [RHEL-39712] {CVE-2024-36017} - netfilter: nf_tables: discard table flag update with pending basechain deletion (Phil Sutter) [RHEL-37205] {CVE-2024-35897} - netfilter: nf_tables: reject table flag and netdev basechain updates (Phil Sutter) [RHEL-37205] - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (Ewan D. Milne) [RHEL-40172] {CVE-2024-36924} - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (Ewan D. Milne) [RHEL-40172] {CVE-2024-36952} - netfilter: nf_tables: fix memleak in map from abort path (Phil Sutter) [RHEL-35052] {CVE-2024-27011} - netfilter: nf_tables: reject new basechain after table flag update (Phil Sutter) [RHEL-37193] {CVE-2024-35900} - netfilter: nf_tables: flush pending destroy work before exit_net release (Phil Sutter) [RHEL-37197] {CVE-2024-35899} - netfilter: complete validation of user input (Phil Sutter) [RHEL-37210] - netfilter: validate user input for expected length (Phil Sutter) [RHEL-37210] {CVE-2024-35896} - netfilter: tproxy: bail out if IP has been disabled on the device (Phil Sutter) [RHEL-44363] {CVE-2024-36270} - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (Phil Sutter) [RHEL-44532] {CVE-2024-36286} - netfilter: nf_tables: do not compare internal table flags on updates (Phil Sutter) [RHEL-35114] {CVE-2024-27065} - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (Phil Sutter) [RHEL-35028] {CVE-2024-27019} - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (Phil Sutter) [RHEL-35024] {CVE-2024-27020} - netfilter: nf_tables: __nft_expr_type_get() selects specific family type (Phil Sutter) [RHEL-35024] - netfilter: conntrack: serialize hash resizes and cleanups (Phil Sutter) [RHEL-37703] {CVE-2021-47408} - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (Phil Sutter) [RHEL-34217] {CVE-2024-26925} - netfilter: nf_tables: release batch on table validation from abort path (Phil Sutter) [RHEL-34217] - ipvlan: add ipvlan_route_v6_outbound() helper (Davide Caratti) [RHEL-38319] {CVE-2023-52796} - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.23.1.rt7.364.el8_10 [RHEL-59541] - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002] - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924} - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042} - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070} - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898} - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301} - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976} - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540} - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284} - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857} - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924} - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983} - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854} - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936} - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093} - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961} - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880} - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244} - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984} - [rt] build kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 [RHEL-53529] - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071} - [rt] build kernel-rt-4.18.0-553.21.1.rt7.362.el8_10 [RHEL-53529] - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874] - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558} - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441} - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904} - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322} - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246} - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008} - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228} - [rt] build kernel-rt-4.18.0-553.20.1.rt7.361.el8_10 [RHEL-53529] - KVM: arm64: Disassociate vcpus from redistributor region on teardown (Shaoqin Huang) [RHEL-48417] {CVE-2024-40989} - devres: Fix memory leakage caused by driver API devm_free_percpu() (CKI Backport Bot) [RHEL-55597] {CVE-2024-43871} - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (Izabela Bakollari) [RHEL-26680] {CVE-2024-26600} - nvmet-fc: avoid deadlock on delete association path (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - nvmet-fc: release reference on target port (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - ACPI: LPIT: Avoid u32 multiplication overflow (Mark Langsdorf) [RHEL-37062] {CVE-2023-52683} - sched/deadline: Fix task_struct reference leak (Phil Auld) [RHEL-50904] {CVE-2024-41023} - nfsd: fix crash on LOCKT on reexported NFSv3 (Benjamin Coddington) [RHEL-31515] - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path (CKI Backport Bot) [RHEL-26570] {CVE-2024-26595} - mlxsw: spectrum_acl_tcam: Move devlink param to TCAM code (Ivan Vecera) [RHEL-26570] {CVE-2024-26595} - ACPI: extlog: fix NULL pointer dereference check (Mark Langsdorf) [RHEL-29110] {CVE-2023-52605} - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() (Mark Langsdorf) [RHEL-33198] {CVE-2024-26894} - mm: prevent derefencing NULL ptr in pfn_section_valid() (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - mm, kmsan: fix infinite recursion due to RCU critical section (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - cipso: make cipso_v4_skbuff_delattr() fully remove the CIPSO options (Ondrej Mosnacek) [RHEL-30904] - cipso: fix total option length computation (Ondrej Mosnacek) [RHEL-30904] - ext4: do not create EA inode under buffer lock (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: check the return value of ext4_xattr_inode_dec_ref() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (Carlos Maiolino) [RHEL-48507] {CVE-2024-40998} - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - [rt] build kernel-rt-4.18.0-553.19.1.rt7.360.el8_10 [RHEL-53529] - drm/i915/vma: Fix UAF on destroy against retire race (Mika Penttilä) [RHEL-35222] {CVE-2024-26939} - RHEL-48620 (Kenneth Yin) [RHEL-48620] - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (CKI Backport Bot) [RHEL-42721] {CVE-2024-26855} - net: usb: asix: do not force pause frames support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix "can't send until first packet is send" issue (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix modprobe "sysfs: cannot create duplicate filename" (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: add proper error handling of usb read errors (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix wrong return value in asix_check_host_enable() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix uninit-value in asix_mdio_read() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: fix boolconv.cocci warnings (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: do not call phy_disconnect() for ax88178 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: move embedded PHY detection as early as possible (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix uninit value bugs (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add missing stop (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: suspend PHY on driver probe (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: manage PHY PM from MAC (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: add error handling for asix_mdio_* functions (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add phylib support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: refactor asix_read_phy_addr() and handle errors on return (Ken Cox) [RHEL-28108] {CVE-2021-47101} - SUNRPC: always free ctxt when freeing deferred request (Jay Shin) [RHEL-40936] - SUNRPC: double free xprt_ctxt while still in use (Jay Shin) [RHEL-40936] - SUNRPC: Remove svc_rqst::rq_xprt_hlen (Jay Shin) [RHEL-40936] - SUNRPC: Remove dead code in svc_tcp_release_rqst() (Jay Shin) [RHEL-40936] - x86/bugs: Extend VMware Retbleed workaround to Nehalem & earlier CPUs (Waiman Long) [RHEL-48646] - wifi: iwlwifi: read txq->read_ptr under lock (Jose Ignacio Tornos Martinez) [RHEL-39797] {CVE-2024-36922} - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (John Meneghini) [RHEL-39908] {CVE-2024-36919} - nbd: always initialize struct msghdr completely (Ming Lei) [RHEL-29498] {CVE-2024-26638} - block: don't call rq_qos_ops->done_bio if the bio isn't tracked (Ming Lei) [RHEL-42151] {CVE-2021-47412} - nvmet: fix a possible leak when destroy a ctrl during qp establishment (Maurizio Lombardi) [RHEL-52013] {CVE-2024-42152} - ipv6: prevent NULL dereference in ip6_output() (Sabrina Dubroca) [RHEL-39912] {CVE-2024-36901} - ppp: reject claimed-as-LCP but actually malformed packets (Guillaume Nault) [RHEL-51052] {CVE-2024-41044} - leds: trigger: Unregister sysfs attributes before calling deactivate() (CKI Backport Bot) [RHEL-54834] {CVE-2024-43830} - crypto: bcm - Fix pointer arithmetic (cki-backport-bot) [RHEL-44108] {CVE-2024-38579} - scsi: qedf: Ensure the copied buf is NUL terminated (John Meneghini) [RHEL-44195] {CVE-2024-38559} - x86/bhi: Avoid warning in #DB handler due to BHI mitigation (Waiman Long) [RHEL-53657] {CVE-2024-42240} - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (CKI Backport Bot) [RHEL-47529] {CVE-2024-40901} - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (CKI Backport Bot) [RHEL-39843] {CVE-2024-36902} - net: usb: ax88179_178a: improve link status logs (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: improve reset check (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: fix link status when link is set to down/up (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: avoid writing the mac address before first reading (Jose Ignacio Tornos Martinez) [RHEL-45167] - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - media: cec: cec-api: add locking in cec_release() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid confusing "transmit timed out" message (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid recursive cec_claim_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: remove length check of Timer Status (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: count low-drive, error and arb-lost conditions (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add note about *_from_edid() function usage in drm (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_unconfigured() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_nb_transmit_canceled() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: don't set last_initiator if tx in progress (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: disable adapter in cec_devnode_unregister (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: not all messages were passed on when monitoring (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add support for Absolute Volume Control (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: log when claiming LA fails unexpectedly (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: drop activate_cnt, use state info instead (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: reconfigure if the PA changes during configuration (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: fix is_configuring state (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: stop trying LAs on CEC_TX_STATUS_TIMEOUT (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't unconfigure if already unconfigured (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add optional adap_configured callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add xfer_timeout_ms field (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: use call_op and check for !unregistered (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix interrupt en/disable handling (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: drop unused 'enabled' field from struct cec_pin (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix off-by-one SFT check (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: rename timer overrun variables (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: correctly pass on reply results (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: abort if the current transmit was canceled (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: call enable_adap on s_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: media/cec.h: document cec_adapter fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix a deadlock situation (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: safely unhook lists in cec_data (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: copy sequence field for the reply (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix trivial style warnings (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: add 'unregistered' checks (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't use flush_scheduled_work() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: Use fallthrough pseudo-keyword (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: remove unused waitq and phys_addrs fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: silence shift wrapping warning in __cec_s_log_addrs() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: move the core to a separate directory (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - net/iucv: Avoid explicit cpumask var allocation on stack (CKI Backport Bot) [RHEL-51631] {CVE-2024-42094} - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (Dick Kennedy) [RHEL-40400] - KVM: selftests: Make hyperv_clock require TSC based system clocksource (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Run clocksource dependent tests with hyperv_clocksource_tsc_page too (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Use generic sys_clocksource_is_tsc() in vmx_nested_tsc_scaling_test (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Generalize check_clocksource() from kvm_clock_test (Vitaly Kuznetsov) [RHEL-19027] - firmware: cs_dsp: Return error if block header overflows file (CKI Backport Bot) [RHEL-53646] {CVE-2024-42238} - firmware: cs_dsp: Validate payload length before processing block (CKI Backport Bot) [RHEL-53638] {CVE-2024-42237} - mm, slub: fix potential memoryleak in kmem_cache_open() (Waiman Long) [RHEL-38404] {CVE-2021-47466} - slub: don't panic for memcg kmem cache creation failure (Waiman Long) [RHEL-38404] {CVE-2021-47466} - wifi: ath11k: fix htt pktlog locking (Jose Ignacio Tornos Martinez) [RHEL-38317] {CVE-2023-52800} - wifi: ath11k: fix dfs radar event locking (Jose Ignacio Tornos Martinez) [RHEL-38165] {CVE-2023-52798} - lib/generic-radix-tree.c: Don't overflow in peek() (Waiman Long) [RHEL-37737] {CVE-2021-47432} - include/linux/generic-radix-tree.h: replace kernel.h with the necessary inclusions (Waiman Long) [RHEL-37737] {CVE-2021-47432} - EDAC/i10nm: Skip the absent memory controllers (Aristeu Rozanski) [RHEL-43236] - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (John Meneghini) [RHEL-38197] {CVE-2023-52809} - gfs2: Fix potential glock use-after-free on unmount (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: simplify gdlm_put_lock with out_free label (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: Remove ill-placed consistency check (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - nvme-fc: do not wait in vain when unloading module (Ewan D. Milne) [RHEL-33083] {CVE-2024-26846} - HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts (CKI Backport Bot) [RHEL-49698] {CVE-2022-48866} - scsi: qedf: Set qed_slowpath_params to zero before use (John Meneghini) [RHEL-9797] - scsi: qedf: Wait for stag work during unload (John Meneghini) [RHEL-9797] - scsi: qedf: Don't process stag work during unload and recovery (John Meneghini) [RHEL-9797] - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - mm: avoid overflows in dirty throttling logic (Audra Mitchell) [RHEL-51840] {CVE-2024-42131} - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - ACPI: fix NULL pointer dereference (Mark Langsdorf) [RHEL-37897] {CVE-2021-47289} - [rt] build kernel-rt-4.18.0-553.18.1.rt7.359.el8_10 [RHEL-53529] - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING (Ewan D. Milne) [RHEL-39805] {CVE-2024-36920} - tun: limit printing rate when illegal packet received by tun dev (Jon Maloy) [RHEL-35046] {CVE-2024-27013} - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu/mes: fix use-after-free issue (Michel Dänzer) [RHEL-44043] {CVE-2024-38581} - drm/amdgpu: Fix the null pointer when load rlc firmware (Michel Dänzer) [RHEL-30603] {CVE-2024-26649} - drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (Michel Dänzer) [RHEL-35160] {CVE-2024-27042} - net/sched: Fix UAF when resolving a clash (Xin Long) [RHEL-51014] {CVE-2024-41040} - tcp_metrics: validate source addr length (Guillaume Nault) [RHEL-52025] {CVE-2024-42154} - NFSv4/pnfs: Fix a use-after-free bug in open (Benjamin Coddington) [RHEL-35508] - NFSv4: Don't hold the layoutget locks across multiple RPC calls (Benjamin Coddington) [RHEL-35508] - scsi: qedf: Make qedf_execute_tmf() non-preemptible (John Meneghini) [RHEL-51799] {CVE-2024-42124} - Input: elantech - fix stack out of bound access in elantech_change_report_id() (CKI Backport Bot) [RHEL-41938] {CVE-2021-47097} - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (CKI Backport Bot) [RHEL-28982] {CVE-2023-52478} - drm/radeon: fix UBSAN warning in kv_dpm.c (CKI Backport Bot) [RHEL-48399] {CVE-2024-40988} - usb: core: Don't hold the device lock while sleeping in do_proc_control() (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - USB: core: Make do_proc_control() and do_proc_bulk() killable (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - scsi: qedi: Fix crash while reading debugfs attribute (CKI Backport Bot) [RHEL-48327] {CVE-2024-40978} - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CKI Backport Bot) [RHEL-48309] {CVE-2024-40977} - net: tcp: accept old ack during closing (Jamie Bainbridge) [RHEL-52433] - wifi: iwlwifi: mvm: don't read past the mfuart notifcation (CKI Backport Bot) [RHEL-48016] {CVE-2024-40941} - net/iucv: fix use after free in iucv_sock_close() (Mete Durlu) [RHEL-53988] - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (CKI Backport Bot) [RHEL-47908] {CVE-2024-40929} - Input: aiptek - properly check endpoint type (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - use descriptors of current altsetting (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - fix endpoint sanity check (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB (CKI Backport Bot) [RHEL-52373] {CVE-2024-42226} - wifi: mt76: replace skb_put with skb_put_zero (CKI Backport Bot) [RHEL-52366] {CVE-2024-42225} - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (CKI Backport Bot) [RHEL-47776] {CVE-2024-40912} - wifi: cfg80211: Lock wiphy in cfg80211_get_station (CKI Backport Bot) [RHEL-47758] {CVE-2024-40911} - VMCI: Use struct_size() in kmalloc() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() (Steve Best) [RHEL-37325] {CVE-2024-35944} - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values (Jose Ignacio Tornos Martinez) [RHEL-51761] {CVE-2024-42114} - usb: atm: cxacru: fix endpoint checking in cxacru_bind() (CKI Backport Bot) [RHEL-51442] {CVE-2024-41097} - nfs: handle error of rpc_proc_register() in init_nfs_fs() (Scott Mayhew) [RHEL-39904] {CVE-2024-36939} - drm/radeon: check bo_va->bo is non-NULL before using it (CKI Backport Bot) [RHEL-51184] {CVE-2024-41060} - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). (CKI Backport Bot) [RHEL-51027] {CVE-2024-41041} - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (CKI Backport Bot) [RHEL-50961] {CVE-2024-41035} - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). (CKI Backport Bot) [RHEL-44408] {CVE-2024-37356} - tcp: avoid too many retransmit packets (Florian Westphal) [RHEL-48627] {CVE-2024-41007} - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() (Florian Westphal) [RHEL-48627] - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Florian Westphal) [RHEL-48627] - tcp: refactor tcp_retransmit_timer() (Florian Westphal) [RHEL-48627] - tcp: exit if nothing to retransmit on RTO timeout (Florian Westphal) [RHEL-48627] - netfilter: nf_tables: Reject tables of unsupported family (Florian Westphal) [RHEL-21418] {CVE-2023-6040} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.23.1.rt7.364.el8_10 [RHEL-59541] - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002] - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924} - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042} - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070} - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898} - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301} - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976} - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540} - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284} - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857} - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924} - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983} - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854} - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936} - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093} - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961} - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880} - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244} - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984} - [rt] build kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 [RHEL-53529] - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071} - [rt] build kernel-rt-4.18.0-553.21.1.rt7.362.el8_10 [RHEL-53529] - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874] - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558} - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441} - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904} - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322} - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246} - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008} - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228} - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.23.1.rt7.364.el8_10 [RHEL-59541] - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002] - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924} - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042} - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070} - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898} - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301} - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976} - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540} - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284} - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857} - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924} - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983} - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854} - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936} - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093} - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961} - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880} - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244} - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - [rt] build kernel-rt-4.18.0-553.35.1.rt7.376.el8_10 [RHEL-72569] - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480] - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480] - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396] - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - [rt] build kernel-rt-4.18.0-553.35.1.rt7.376.el8_10 [RHEL-72569] - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480] - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480] - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396] - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - [rt] build kernel-rt-4.18.0-553.35.1.rt7.376.el8_10 [RHEL-72569] - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480] - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480] - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396] - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.5.1.rt7.346.el8_10 [RHEL-34640] - tools/power/turbostat: Fix uncore frequency file string (David Arcari) [RHEL-29238] - tools/power turbostat: Expand probe_intel_uncore_frequency() (David Arcari) [RHEL-29238] - uio: Fix use-after-free in uio_open (Ricardo Robaina) [RHEL-26232] {CVE-2023-52439} - net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (Ken Cox) [RHEL-27316] {CVE-2021-47013} - keys: Fix linking a duplicate key to a keyring's assoc_array (David Howells) [RHEL-30772] - keys: Hoist locking out of __key_link_begin() (David Howells) [RHEL-30772] - keys: Break bits out of key_unlink() (David Howells) [RHEL-30772] - keys: Change keyring_serialise_link_sem to a mutex (David Howells) [RHEL-30772] - wifi: brcm80211: handle pmk_op allocation failure (Jose Ignacio Tornos Martinez) [RHEL-35150] {CVE-2024-27048} - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work (Jose Ignacio Tornos Martinez) [RHEL-35140] {CVE-2024-27052} - wifi: iwlwifi: mvm: ensure offloading TID queue exists (Jose Ignacio Tornos Martinez) [RHEL-35130] {CVE-2024-27056} - wifi: mt76: mt7921e: fix use-after-free in free_irq() (Jose Ignacio Tornos Martinez) [RHEL-34866] {CVE-2024-26892} - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete (Jose Ignacio Tornos Martinez) [RHEL-34189] {CVE-2024-26897} - wifi: iwlwifi: mvm: fix a crash when we run out of stations (Jose Ignacio Tornos Martinez) [RHEL-31547] {CVE-2024-26693} - wifi: iwlwifi: fix double-free bug (Jose Ignacio Tornos Martinez) [RHEL-31543] {CVE-2024-26694} - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (Jose Ignacio Tornos Martinez) [RHEL-29089] {CVE-2023-52594} - wifi: rt2x00: restart beacon queue when hardware reset (Jose Ignacio Tornos Martinez) [RHEL-29093] {CVE-2023-52595} - wifi: iwlwifi: fix a memory corruption (Jose Ignacio Tornos Martinez) [RHEL-28903] {CVE-2024-26610} - [rt] build kernel-rt-4.18.0-553.4.1.rt7.345.el8_10 [RHEL-34640] - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117] - net/mlx5e: Prevent deadlock while disabling aRFS (Kamal Heib) [RHEL-35041] {CVE-2024-27014} - x86/tsc: Defer marking TSC unstable to a worker (Wander Lairson Costa) [RHEL-32676] - x86/smpboot: Make TSC synchronization function call based (Wander Lairson Costa) [RHEL-32676] - net: usb: fix possible use-after-free in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - net: usb: fix memory leak in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - [rt] build kernel-rt-4.18.0-552.3.1.rt7.344.el8_10 [RHEL-34640] - netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (Phil Sutter) [RHEL-30076] {CVE-2024-26643} - netfilter: nf_tables: disallow anonymous set with timeout flag (Phil Sutter) [RHEL-30080] {CVE-2024-26642} - selftests/bpf: Fix pyperf180 compilation failure with clang18 (Artem Savkov) [RHEL-35576] - md/raid5: fix atomicity violation in raid5_cache_count (Nigel Croxon) [RHEL-27930] {CVE-2024-23307} - usb: ulpi: Fix debugfs directory leak (Desnes Nunes) [RHEL-33287] {CVE-2024-26919} - powerpc/pseries: Fix potential memleak in papr_get_attr() (Mamatha Inamdar) [RHEL-35213] {CVE-2022-48669} - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (Desnes Nunes) [RHEL-35122] {CVE-2024-27059} - NFSv4: fairly test all delegations on a SEQ4_ revocation (Benjamin Coddington) [RHEL-34912] - USB: core: Fix deadlock in usb_deauthorize_interface() (Desnes Nunes) [RHEL-35002] {CVE-2024-26934} - usb: xhci: Add error handling in xhci_map_urb_for_dma (Desnes Nunes) [RHEL-34958] {CVE-2024-26964} - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (Ewan D. Milne) [RHEL-35076] {CVE-2024-26993} - xhci: handle isoc Babble and Buffer Overrun events properly (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - xhci: process isoc TD properly when there was a transaction error mid TD. (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - USB: core: Fix deadlock in port "disable" sysfs attribute (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - USB: core: Add hub_get() and hub_put() routines (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - netfilter: ipset: Missing gc cancellations fixed (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix performance regression in swap operation (Phil Sutter) [RHEL-30521] - netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test (Phil Sutter) [RHEL-30521] - x86/apic/x2apic: Fix a NULL pointer deref when handling a dying cpu (David Arcari) [RHEL-32516] - x86/coco: Disable 32-bit emulation by default on TDX and SEV (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Make IA32_EMULATION boot time configurable (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/elf: Make loading of 32bit processes depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Rename ignore_sysret() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/cpu: Don't write CSTAR MSR on Intel CPUs (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Introduce ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - [rt] build kernel-rt-4.18.0-552.2.1.rt7.343.el8_10 [RHEL-34640] - s390/ptrace: handle setting of fpc register correctly (Tobias Huschle) [RHEL-29106] {CVE-2023-52598} - net/smc: fix illegal rmb_desc access in SMC-D connection dump (Tobias Huschle) [RHEL-27746] {CVE-2024-26615} - wifi: mac80211: fix race condition on enabling fast-xmit (Jose Ignacio Tornos Martinez) [RHEL-31664] {CVE-2024-26779} - powerpc/fadump: make is_kdump_kernel() return false when fadump is active (Mamatha Inamdar) [RHEL-24401] - vmcore: remove dependency with is_kdump_kernel() for exporting vmcore (Mamatha Inamdar) [RHEL-24401] - mtd: require write permissions for locking and badblock ioctls (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - mtd: properly check all write ioctls for permissions (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - pid: take a reference when initializing `cad_pid` (Waiman Long) [RHEL-29420] {CVE-2021-47118} - i2c: i801: Don't generate an interrupt on bus reset (Prarit Bhargava) [RHEL-30325] {CVE-2021-47153} - RDMA/srpt: Do not register event handler until srpt device is fully setup (Kamal Heib) [RHEL-33224] {CVE-2024-26872} - ceph: switch to corrected encoding of max_xattr_size in mdsmap (Xiubo Li) [RHEL-26723] - ceph: switch to use cap_delay_lock for the unlink delay list (Xiubo Li) [RHEL-32870] - ceph: pass ino# instead of old_dentry if it's disconnected (Xiubo Li) [RHEL-32870] - fat: fix uninitialized field in nostale filehandles (Andrey Albershteyn) [RHEL-33186 RHEL-35108] {CVE-2024-26973} - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (Andrey Albershteyn) [RHEL-33186] {CVE-2024-26901} - idpf: limit the support to GCP only (Michal Schmidt) [RHEL-15652] - redhat/configs: enable CONFIG_IDPF (Michal Schmidt) [RHEL-15652] - idpf: remove the use of ETHTOOL_RING_USE_TCP_DATA_SPLIT (Michal Schmidt) [RHEL-15652] - idpf: workaround for unavailable skb page recycling (Michal Schmidt) [RHEL-15652] - idpf: always allocate a full page (Michal Schmidt) [RHEL-15652] - idpf: remove page pool stats code (Michal Schmidt) [RHEL-15652] - idpf: add minimal macros for __free(kfree) to work (Michal Schmidt) [RHEL-15652] - idpf: fixup include paths for RHEL 8 (Michal Schmidt) [RHEL-15652] - idpf: fix kernel panic on unknown packet types (Michal Schmidt) [RHEL-15652] - idpf: disable local BH when scheduling napi for marker packets (Michal Schmidt) [RHEL-15652] - idpf: remove dealloc vector msg err in idpf_intr_rel (Michal Schmidt) [RHEL-15652] - idpf: fix minor controlq issues (Michal Schmidt) [RHEL-15652] - idpf: prevent deinit uninitialized virtchnl core (Michal Schmidt) [RHEL-15652] - idpf: cleanup virtchnl cruft (Michal Schmidt) [RHEL-15652] - idpf: refactor idpf_recv_mb_msg (Michal Schmidt) [RHEL-15652] - idpf: add async_handler for MAC filter messages (Michal Schmidt) [RHEL-15652] - idpf: refactor remaining virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor queue related virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor vport virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: implement virtchnl transaction manager (Michal Schmidt) [RHEL-15652] - idpf: add idpf_virtchnl.h (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler padding in virtchnl2_ptype struct (Michal Schmidt) [RHEL-15652] - idpf: distinguish vports by the dev_port attribute (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler introduced padding in virtchnl2_rss_key struct (Michal Schmidt) [RHEL-15652] - idpf: fix corrupted frames and skb leaks in singleq mode (Michal Schmidt) [RHEL-15652] - idpf: refactor some missing field get/prep conversions (Michal Schmidt) [RHEL-15652] - idpf: add get/set for Ethtool's header split ringparam (Michal Schmidt) [RHEL-15652] - idpf: fix potential use-after-free in idpf_tso() (Michal Schmidt) [RHEL-15652] - idpf: cancel mailbox work in error path (Michal Schmidt) [RHEL-15652] - idpf: set scheduling mode for completion queue (Michal Schmidt) [RHEL-15652] - idpf: add SRIOV support and other ndo_ops (Michal Schmidt) [RHEL-15652] - idpf: add ethtool callbacks (Michal Schmidt) [RHEL-15652] - idpf: add singleq start_xmit and napi poll (Michal Schmidt) [RHEL-15652] - idpf: add RX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add TX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add splitq start_xmit (Michal Schmidt) [RHEL-15652] - idpf: initialize interrupts and enable vport (Michal Schmidt) [RHEL-15652] - idpf: configure resources for RX queues (Michal Schmidt) [RHEL-15652] - idpf: configure resources for TX queues (Michal Schmidt) [RHEL-15652] - idpf: add ptypes and MAC filter support (Michal Schmidt) [RHEL-15652] - idpf: add create vport and netdev configuration (Michal Schmidt) [RHEL-15652] - idpf: add core init and interrupt request (Michal Schmidt) [RHEL-15652] - idpf: add controlq init and reset checks (Michal Schmidt) [RHEL-15652] - idpf: add module register and probe functionality (Michal Schmidt) [RHEL-15652] - virtchnl: add virtchnl version 2 ops (Michal Schmidt) [RHEL-15652] - net: netdev_queue: netdev_txq_completed_mb(): fix wake condition (Michal Schmidt) [RHEL-15652] - net: piggy back on the memory barrier in bql when waking queues (Michal Schmidt) [RHEL-15652] - net: provide macros for commonly copied lockless queue stop/wake code (Michal Schmidt) [RHEL-15652] - [rt] build kernel-rt-4.18.0-552.1.1.rt7.342.el8_10 [RHEL-34640] - build: Update RTBZ for 8.10 z-stream builds (Denys Vlasenko) - redhat: set DIST to el8_10 and ZSTREAM to yes for 8.10 (Denys Vlasenko) - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (Prarit Bhargava) [RHEL-32590] {CVE-2021-47185} - net: mana: Fix Rx DMA datasize and skb_over_panic (Cathy Avery) [RHEL-32579] - RDMA/srpt: Support specifying the srpt_service_guid parameter (Kamal Heib) [RHEL-31710] {CVE-2024-26744} - RDMA/qedr: Fix qedr_create_user_qp error flow (Kamal Heib) [RHEL-31714] {CVE-2024-26743} - hwmon: (coretemp) Fix out-of-bounds memory access (David Arcari) [RHEL-31305] {CVE-2024-26664} - RDMA/irdma: Fix KASAN issue with tasklet (Kamal Heib) [RHEL-15776] - net: bridge: use DEV_STATS_INC() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: Fix unwanted sign extension in netdev_stats_to_stats64() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: add atomic_long_t to net_device_stats fields (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net/sched: act_ct: fix skb leak and crash on ooo frags (Xin Long) [RHEL-29467] {CVE-2023-52610} - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Jose Ignacio Tornos Martinez) [RHEL-28015] {CVE-2023-52528} - RDMA/core: Fix uninit-value access in ib_get_eth_speed() (Kamal Heib) [RHEL-30130] - RDMA/core: Get IB width and speed from netdev (Kamal Heib) [RHEL-30130] - cpufreq: intel_pstate: Add Emerald Rapids support in no-HWP mode (Prarit Bhargava) [RHEL-29444] - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add (Mamatha Inamdar) [RHEL-29118] {CVE-2023-52607} - powerpc/lib: Validate size for vector operations (Mamatha Inamdar) [RHEL-29114] {CVE-2023-52606} - usb: hub: Guard against accesses to uninitialized BOS descriptors (Desnes Nunes) [RHEL-28986] {CVE-2023-52477} - media: uvcvideo: Fix OOB read (Desnes Nunes) [RHEL-27940] {CVE-2023-52565} - media: pvrusb2: fix use after free on context disconnection (Desnes Nunes) [RHEL-26498] {CVE-2023-52445} - i2c: i801: Fix block process call transactions (Prarit Bhargava) [RHEL-26478] {CVE-2024-26593} - overlay: disable EVM (Coiby Xu) [RHEL-19863] - evm: add support to disable EVM on unsupported filesystems (Coiby Xu) [RHEL-19863] - evm: don't copy up 'security.evm' xattr (Coiby Xu) [RHEL-19863] - net: ena: Remove ena_select_queue (Kamal Heib) [RHEL-14286] - media: dvbdev: Fix memory leak in dvb_media_device_free() (Prarit Bhargava) [RHEL-27254] {CVE-2020-36777} - gfs2: Fix invalid metadata access in punch_hole (Andrew Price) [RHEL-28784] - i2c: Fix a potential use after free (Prarit Bhargava) [RHEL-26849] {CVE-2019-25162} - i2c: validate user data in compat ioctl (Prarit Bhargava) [RHEL-27022] {CVE-2021-46934} - platform/x86: think-lmi: Fix reference leak (Prarit Bhargava) [RHEL-28030] {CVE-2023-52520} - vhost: use kzalloc() instead of kmalloc() followed by memset() (Jon Maloy) [RHEL-21505] {CVE-2024-0340} - RDMA/siw: Fix connection failure handling (Kamal Heib) [RHEL-28042] {CVE-2023-52513} - vt: fix memory overlapping when deleting chars in the buffer (Waiman Long) [RHEL-27778 RHEL-27779] {CVE-2022-48627} - x86/fpu: Stop relying on userspace for info to fault in xsave buffer (Steve Best) [RHEL-26669] {CVE-2024-26603} - mptcp: fix double-free on socket dismantle (Davide Caratti) [RHEL-22773] {CVE-2024-26782} - crypto: akcipher - Disable signing and decryption (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: akcipher - default implementations for request callbacks (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: testmgr - split akcipher tests by a key type (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - workqueue: Warn when a rescuer could not be created (Waiman Long) [RHEL-22136] - RDMA/cma: Avoid GID lookups on iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/cma: Deduplicate error flow in cma_validate_port() (Benjamin Coddington) [RHEL-12456] - RDMA/core: Set gid_attr.ndev for iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/siw: Fabricate a GID on tun and loopback devices (Benjamin Coddington) [RHEL-12456] - eventpoll: fix missing wakeup for ovflist in ep_poll_callback (Luis Claudio R. Goncalves) [RHEL-23022] - [rt] build kernel-rt-4.18.0-552.rt7.341.el8 [RHEL-5332] - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248] - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248] - [rt] build kernel-rt-4.18.0-551.rt7.340.el8 [RHEL-5332] - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742} - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992] - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992] - [rt] build kernel-rt-4.18.0-550.rt7.339.el8 [RHEL-5332] - mm/sparsemem: fix race in accessing memory_section->usage (Waiman Long) [RHEL-28875 RHEL-28876] {CVE-2023-52489} - mm: use __pfn_to_section() instead of open coding it (Waiman Long) [RHEL-28875] {CVE-2023-52489} - [rt] build kernel-rt-4.18.0-549.rt7.338.el8 [RHEL-5332] - dm-integrity: align the outgoing bio in integrity_recheck (Benjamin Marzinski) [RHEL-29678] - dm-integrity: fix a memory leak when rechecking the data (Benjamin Marzinski) [RHEL-29678] - RDMA/mana_ib: Add CQ interrupt support for RAW QP (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: query device capabilities (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: register RDMA device with GDMA (Maxim Levitsky) [RHEL-23934] - net: mana: add msix index sharing between EQs (Maxim Levitsky) [RHEL-23934] - net: mana: Fix spelling mistake "enforecement" -> "enforcement" (Maxim Levitsky) [RHEL-23934] - net :mana :Add remaining GDMA stats for MANA to ethtool (Maxim Levitsky) [RHEL-23934] - net: mana: Fix oversized sge0 for GSO packets (Maxim Levitsky) [RHEL-23934] - net: mana: Fix TX CQE error handling (Maxim Levitsky) [RHEL-23934] - net: mana: Add gdma stats to ethtool output for mana (Maxim Levitsky) [RHEL-23934] - net: mana: Fix MANA VF unload when hardware is unresponsive (Maxim Levitsky) [RHEL-23934] - net: mana: Configure hwc timeout from hardware (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (Maxim Levitsky) [RHEL-23934] - [rt] build kernel-rt-4.18.0-548.rt7.337.el8 [RHEL-5332] - gitlab-ci: enable arm64/s390x/ppc64le debug builds (Michael Hofmann) - arm64: Add missing bits of AmpereOne Spectre-BHB mitigation (Mark Salter) [RHEL-29005] - [rt] enable CONFIG_DRM_MGAG200_IOBURST_WORKAROUND (Jocelyn Falempe) [RHEL-13214] - drm/mgag200: Add a workaround for low-latency (Jocelyn Falempe) [RHEL-13214] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - [rt] build kernel-rt-4.18.0-553.8.1.rt7.349.el8_10 [RHEL-40882] - udf: Fix NULL pointer dereference in udf_symlink function (Pavel Reichl) [RHEL-37769] {CVE-2021-47353} - net: ti: fix UAF in tlan_remove_one (Jose Ignacio Tornos Martinez) [RHEL-38940] {CVE-2021-47310} - ARM: footbridge: fix PCI interrupt mapping (Myron Stowe) [RHEL-26971] {CVE-2021-46909} - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (Kamal Heib) [RHEL-37454] {CVE-2024-36004} - net/mlx5e: Fix mlx5e_priv_init() cleanup flow (Kamal Heib) [RHEL-37424] {CVE-2024-35959} - net/mlx5: Properly link new fs rules into the tree (Kamal Heib) [RHEL-37420] {CVE-2024-35960} - net/mlx5e: fix a potential double-free in fs_any_create_groups (Kamal Heib) [RHEL-37091] {CVE-2023-52667} - net: ena: Fix incorrect descriptor free behavior (Kamal Heib) [RHEL-37428] {CVE-2024-35958} - mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - mISDN: fix possible use-after-free in HFC_cleanup() (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - implement dh fallback for primes > 4K (Vladis Dronov) [RHEL-35106] - crypto: qat - avoid division by zero (Vladis Dronov) [RHEL-35106] - crypto: qat - resolve race condition during AER recovery (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - use kcalloc_node() instead of kzalloc_node() (Vladis Dronov) [RHEL-35106] - [rt] Enable CONFIG_DRM_MGAG200_DISABLE_WRITECOMBINE (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Add an option to disable Write-Combine (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Fix caching setup for remapped video memory (Jocelyn Falempe) [RHEL-36172] - Revert "drm/mgag200: Add a workaround for low-latency" (Jocelyn Falempe) [RHEL-36172] - mptcp: fix data re-injection from stale subflow (Davide Caratti) [RHEL-33133] {CVE-2024-26826} - ipv6: sr: fix incorrect unregister order (Hangbin Liu) [RHEL-31730] - ipv6: sr: fix possible use-after-free and null-ptr-deref (Hangbin Liu) [RHEL-31730] {CVE-2024-26735} - net/bnx2x: Prevent access to a freed page in page_pool (Michal Schmidt) [RHEL-14195 RHEL-33243] {CVE-2024-26859} - bnx2x: new flag for track HW resource allocation (Michal Schmidt) [RHEL-14195 RHEL-33243] - bnx2x: fix page fault following EEH recovery (Michal Schmidt) [RHEL-14195 RHEL-33243] - x86: KVM: SVM: always update the x2avic msr interception (Maxim Levitsky) [RHEL-15495] {CVE-2023-5090} - EDAC/thunderx: Fix possible out-of-bounds string access (Aristeu Rozanski) [RHEL-26573] {CVE-2023-52464} - [rt] build kernel-rt-4.18.0-553.7.1.rt7.348.el8_10 [RHEL-34640] - net: qcom/emac: fix UAF in emac_remove (Ken Cox) [RHEL-37834] {CVE-2021-47311} - perf/core: Bail out early if the request AUX area is out of bound (Michael Petlan) [RHEL-38268] {CVE-2023-52835} - crypto: pcrypt - Fix hungtask for PADATA_RESET (Herbert Xu) [RHEL-38171] {CVE-2023-52813} - drm/amdgpu: fix use-after-free bug (Jocelyn Falempe) [RHEL-31240] {CVE-2024-26656} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash (Ivan Vecera) [RHEL-37008] {CVE-2024-35854} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update (Ivan Vecera) [RHEL-37004] {CVE-2024-35855} - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (Ivan Vecera) [RHEL-37012] {CVE-2024-35853} - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work (Ivan Vecera) [RHEL-37016] {CVE-2024-35852} - mlxsw: spectrum_acl_tcam: Fix warning during rehash (Ivan Vecera) [RHEL-37480] {CVE-2024-36007} - can: peak_pci: peak_pci_remove(): fix UAF (Jose Ignacio Tornos Martinez) [RHEL-38419] {CVE-2021-47456} - usbnet: fix error return code in usbnet_probe() (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - usbnet: sanity check for maxpacket (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - net/mlx5e: fix a double-free in arfs_create_groups (Kamal Heib) [RHEL-36920] {CVE-2024-35835} - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds (Jose Ignacio Tornos Martinez) [RHEL-38220] {CVE-2023-52878} - net: cdc_eem: fix tx fixup skb leak (Jose Ignacio Tornos Martinez) [RHEL-38080] {CVE-2021-47236} - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Jose Ignacio Tornos Martinez) [RHEL-38113] {CVE-2023-52703} - usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() (Desnes Nunes) [RHEL-38248] {CVE-2023-52877} - usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (Desnes Nunes) [RHEL-38240] {CVE-2023-52781} - gro: fix ownership transfer (Xin Long) [RHEL-37226] {CVE-2024-35890} - tipc: fix kernel warning when sending SYN message (Xin Long) [RHEL-38109] {CVE-2023-52700} - erspan: make sure erspan_base_hdr is present in skb->head (Xin Long) [RHEL-37230] {CVE-2024-35888} - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() (Bryan Gurney) [RHEL-17366] - scsi: mpi3mr: Sanitise num_phys (Bryan Gurney) [RHEL-17366] - netfilter: nf_tables: use timestamp to check for set element timeout (Phil Sutter) [RHEL-38023] {CVE-2024-27397} - net/ipv6: SKB symmetric hash should incorporate transport ports (Sabrina Dubroca) [RHEL-32061] - crypto: s390/aes - Fix buffer overread in CTR mode (Herbert Xu) [RHEL-37089] {CVE-2023-52669} - net: Save and restore msg_namelen in sock_sendmsg (Jamie Bainbridge) [RHEL-35893] - net: prevent address rewrite in kernel_bind() (Jamie Bainbridge) [RHEL-35893] - net: prevent rewrite of msg_name in sock_sendmsg() (Jamie Bainbridge) [RHEL-35893] - net: replace calls to sock->ops->connect() with kernel_connect() (Jamie Bainbridge) [RHEL-35893] - net: Avoid address overwrite in kernel_connect (Jamie Bainbridge) [RHEL-35893] - wifi: iwlwifi: dbg-tlv: ensure NUL termination (Jose Ignacio Tornos Martinez) [RHEL-37026] {CVE-2024-35845} - wifi: mac80211: fix potential sta-link leak (Jose Ignacio Tornos Martinez) [RHEL-36916] {CVE-2024-35838} - wifi: nl80211: reject iftype change with mesh ID change (Jose Ignacio Tornos Martinez) [RHEL-36884] {CVE-2024-27410} - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (Jose Ignacio Tornos Martinez) [RHEL-36807] {CVE-2024-35789} - Bluetooth: Avoid potential use-after-free in hci_error_reset (David Marlin) [RHEL-31826] {CVE-2024-26801} - tls: disable async encrypt/decrypt (Sabrina Dubroca) [RHEL-26362 RHEL-26409 RHEL-26420] {CVE-2024-26585 CVE-2024-26583 CVE-2024-26584} - Squashfs: check the inode number is not the invalid value of zero (Phillip Lougher) [RHEL-35096] {CVE-2024-26982} - ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/msg.c: update and document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/sem.c: document and update memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: update/document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: remove duplicated code (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (Kamal Heib) [RHEL-30582] {CVE-2023-52626} - Revert "ACPI: bus: Rework system-level device notification handling" (Prarit Bhargava) [RHEL-21486] - hwrng: core - Fix page fault dead lock on mmap-ed hwrng (Prarit Bhargava) [RHEL-29485] {CVE-2023-52615} - [rt] build kernel-rt-4.18.0-553.6.1.rt7.347.el8_10 [RHEL-34640] - cxgb4: Properly lock TX queue for the selftest. (John B. Wyatt IV) [RHEL-8779] - powerpc/powernv: Add a null pointer check in opal_event_init() (Mamatha Inamdar) [RHEL-37058] {CVE-2023-52686} - crypto: rsa - add a check for allocation failure (Vladis Dronov) [RHEL-35361] - crypto: rsa - allow only odd e and restrict value in FIPS mode (Vladis Dronov) [RHEL-35361] - KEYS: use kfree_sensitive with key (Vladis Dronov) [RHEL-35361] - lib/mpi: Extend the MPI library (only mpi_*_bit() part) (Vladis Dronov) [RHEL-35361] - net: ip_tunnel: prevent perpetual headroom growth (Felix Maurer) [RHEL-31814] {CVE-2024-26804} - s390/cpum_cf: make crypto counters upward compatible across machine types (Tobias Huschle) [RHEL-36048] - RDMA/mlx5: Fix fortify source warning while accessing Eth segment (Kamal Heib) [RHEL-33162] {CVE-2024-26907} - ovl: fix leaked dentry (Miklos Szeredi) [RHEL-27306] {CVE-2021-46972} - x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - x86/mm/vsyscall: Consider vsyscall page part of user address space (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - x86/mm: Add vsyscall address helper (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - mm/swap: fix race when skipping swapcache (Rafael Aquini) [RHEL-31644] {CVE-2024-26759} - swap: fix do_swap_page() race with swapoff (Rafael Aquini) [RHEL-31644] {CVE-2024-26759} - mm/swapfile: use percpu_ref to serialize against concurrent swapoff (Rafael Aquini) [RHEL-31644] {CVE-2024-26759} - mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions() (Rafael Aquini) [RHEL-29294] {CVE-2023-52560} - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr (Jiri Benc) [RHEL-29783] - block: null_blk: Fix handling of fake timeout request (Ming Lei) [RHEL-8130] - null_blk: fix poll request timeout handling (Ming Lei) [RHEL-8130] - block: null_blk: end timed out poll request (Ming Lei) [RHEL-8130] - block: null_blk: only set set->nr_maps as 3 if active poll_queues is > 0 (Ming Lei) [RHEL-8130] - null_blk: allow zero poll queues (Ming Lei) [RHEL-8130] - null_blk: Fix handling of submit_queues and poll_queues attributes (Ming Lei) [RHEL-8130] - null_blk: poll queue support (Ming Lei) [RHEL-8130] - null_blk: fix command timeout completion handling (Ming Lei) [RHEL-8130] - platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (Prarit Bhargava) [RHEL-27790] {CVE-2021-47073} - Bluetooth: avoid memcmp() out of bounds warning (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: hci_event: Fix coding style (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: hci_event: Fix using memcmp when comparing keys (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: Reject connection with the device which has same BD_ADDR (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: hci_event: Ignore NULL link key (David Marlin) [RHEL-3017] {CVE-2020-26555} - ppp_async: limit MRU to 64K (Guillaume Nault) [RHEL-31353] {CVE-2024-26675} - powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (Mamatha Inamdar) [RHEL-37078] {CVE-2023-52675} - tcp: do not accept ACK of bytes we never sent (Xin Long) [RHEL-21952] - [rt] build kernel-rt-4.18.0-553.5.1.rt7.346.el8_10 [RHEL-34640] - tools/power/turbostat: Fix uncore frequency file string (David Arcari) [RHEL-29238] - tools/power turbostat: Expand probe_intel_uncore_frequency() (David Arcari) [RHEL-29238] - uio: Fix use-after-free in uio_open (Ricardo Robaina) [RHEL-26232] {CVE-2023-52439} - net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (Ken Cox) [RHEL-27316] {CVE-2021-47013} - keys: Fix linking a duplicate key to a keyring's assoc_array (David Howells) [RHEL-30772] - keys: Hoist locking out of __key_link_begin() (David Howells) [RHEL-30772] - keys: Break bits out of key_unlink() (David Howells) [RHEL-30772] - keys: Change keyring_serialise_link_sem to a mutex (David Howells) [RHEL-30772] - wifi: brcm80211: handle pmk_op allocation failure (Jose Ignacio Tornos Martinez) [RHEL-35150] {CVE-2024-27048} - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work (Jose Ignacio Tornos Martinez) [RHEL-35140] {CVE-2024-27052} - wifi: iwlwifi: mvm: ensure offloading TID queue exists (Jose Ignacio Tornos Martinez) [RHEL-35130] {CVE-2024-27056} - wifi: mt76: mt7921e: fix use-after-free in free_irq() (Jose Ignacio Tornos Martinez) [RHEL-34866] {CVE-2024-26892} - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete (Jose Ignacio Tornos Martinez) [RHEL-34189] {CVE-2024-26897} - wifi: iwlwifi: mvm: fix a crash when we run out of stations (Jose Ignacio Tornos Martinez) [RHEL-31547] {CVE-2024-26693} - wifi: iwlwifi: fix double-free bug (Jose Ignacio Tornos Martinez) [RHEL-31543] {CVE-2024-26694} - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (Jose Ignacio Tornos Martinez) [RHEL-29089] {CVE-2023-52594} - wifi: rt2x00: restart beacon queue when hardware reset (Jose Ignacio Tornos Martinez) [RHEL-29093] {CVE-2023-52595} - wifi: iwlwifi: fix a memory corruption (Jose Ignacio Tornos Martinez) [RHEL-28903] {CVE-2024-26610} - [rt] build kernel-rt-4.18.0-553.4.1.rt7.345.el8_10 [RHEL-34640] - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117] - net/mlx5e: Prevent deadlock while disabling aRFS (Kamal Heib) [RHEL-35041] {CVE-2024-27014} - x86/tsc: Defer marking TSC unstable to a worker (Wander Lairson Costa) [RHEL-32676] - x86/smpboot: Make TSC synchronization function call based (Wander Lairson Costa) [RHEL-32676] - net: usb: fix possible use-after-free in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - net: usb: fix memory leak in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - [rt] build kernel-rt-4.18.0-552.3.1.rt7.344.el8_10 [RHEL-34640] - netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (Phil Sutter) [RHEL-30076] {CVE-2024-26643} - netfilter: nf_tables: disallow anonymous set with timeout flag (Phil Sutter) [RHEL-30080] {CVE-2024-26642} - selftests/bpf: Fix pyperf180 compilation failure with clang18 (Artem Savkov) [RHEL-35576] - md/raid5: fix atomicity violation in raid5_cache_count (Nigel Croxon) [RHEL-27930] {CVE-2024-23307} - usb: ulpi: Fix debugfs directory leak (Desnes Nunes) [RHEL-33287] {CVE-2024-26919} - powerpc/pseries: Fix potential memleak in papr_get_attr() (Mamatha Inamdar) [RHEL-35213] {CVE-2022-48669} - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (Desnes Nunes) [RHEL-35122] {CVE-2024-27059} - NFSv4: fairly test all delegations on a SEQ4_ revocation (Benjamin Coddington) [RHEL-34912] - USB: core: Fix deadlock in usb_deauthorize_interface() (Desnes Nunes) [RHEL-35002] {CVE-2024-26934} - usb: xhci: Add error handling in xhci_map_urb_for_dma (Desnes Nunes) [RHEL-34958] {CVE-2024-26964} - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (Ewan D. Milne) [RHEL-35076] {CVE-2024-26993} - xhci: handle isoc Babble and Buffer Overrun events properly (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - xhci: process isoc TD properly when there was a transaction error mid TD. (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - USB: core: Fix deadlock in port "disable" sysfs attribute (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - USB: core: Add hub_get() and hub_put() routines (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - netfilter: ipset: Missing gc cancellations fixed (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix performance regression in swap operation (Phil Sutter) [RHEL-30521] - netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test (Phil Sutter) [RHEL-30521] - x86/apic/x2apic: Fix a NULL pointer deref when handling a dying cpu (David Arcari) [RHEL-32516] - x86/coco: Disable 32-bit emulation by default on TDX and SEV (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Make IA32_EMULATION boot time configurable (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/elf: Make loading of 32bit processes depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Rename ignore_sysret() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/cpu: Don't write CSTAR MSR on Intel CPUs (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Introduce ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - [rt] build kernel-rt-4.18.0-552.2.1.rt7.343.el8_10 [RHEL-34640] - s390/ptrace: handle setting of fpc register correctly (Tobias Huschle) [RHEL-29106] {CVE-2023-52598} - net/smc: fix illegal rmb_desc access in SMC-D connection dump (Tobias Huschle) [RHEL-27746] {CVE-2024-26615} - wifi: mac80211: fix race condition on enabling fast-xmit (Jose Ignacio Tornos Martinez) [RHEL-31664] {CVE-2024-26779} - powerpc/fadump: make is_kdump_kernel() return false when fadump is active (Mamatha Inamdar) [RHEL-24401] - vmcore: remove dependency with is_kdump_kernel() for exporting vmcore (Mamatha Inamdar) [RHEL-24401] - mtd: require write permissions for locking and badblock ioctls (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - mtd: properly check all write ioctls for permissions (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - pid: take a reference when initializing `cad_pid` (Waiman Long) [RHEL-29420] {CVE-2021-47118} - i2c: i801: Don't generate an interrupt on bus reset (Prarit Bhargava) [RHEL-30325] {CVE-2021-47153} - RDMA/srpt: Do not register event handler until srpt device is fully setup (Kamal Heib) [RHEL-33224] {CVE-2024-26872} - ceph: switch to corrected encoding of max_xattr_size in mdsmap (Xiubo Li) [RHEL-26723] - ceph: switch to use cap_delay_lock for the unlink delay list (Xiubo Li) [RHEL-32870] - ceph: pass ino# instead of old_dentry if it's disconnected (Xiubo Li) [RHEL-32870] - fat: fix uninitialized field in nostale filehandles (Andrey Albershteyn) [RHEL-33186 RHEL-35108] {CVE-2024-26973} - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (Andrey Albershteyn) [RHEL-33186] {CVE-2024-26901} - idpf: limit the support to GCP only (Michal Schmidt) [RHEL-15652] - redhat/configs: enable CONFIG_IDPF (Michal Schmidt) [RHEL-15652] - idpf: remove the use of ETHTOOL_RING_USE_TCP_DATA_SPLIT (Michal Schmidt) [RHEL-15652] - idpf: workaround for unavailable skb page recycling (Michal Schmidt) [RHEL-15652] - idpf: always allocate a full page (Michal Schmidt) [RHEL-15652] - idpf: remove page pool stats code (Michal Schmidt) [RHEL-15652] - idpf: add minimal macros for __free(kfree) to work (Michal Schmidt) [RHEL-15652] - idpf: fixup include paths for RHEL 8 (Michal Schmidt) [RHEL-15652] - idpf: fix kernel panic on unknown packet types (Michal Schmidt) [RHEL-15652] - idpf: disable local BH when scheduling napi for marker packets (Michal Schmidt) [RHEL-15652] - idpf: remove dealloc vector msg err in idpf_intr_rel (Michal Schmidt) [RHEL-15652] - idpf: fix minor controlq issues (Michal Schmidt) [RHEL-15652] - idpf: prevent deinit uninitialized virtchnl core (Michal Schmidt) [RHEL-15652] - idpf: cleanup virtchnl cruft (Michal Schmidt) [RHEL-15652] - idpf: refactor idpf_recv_mb_msg (Michal Schmidt) [RHEL-15652] - idpf: add async_handler for MAC filter messages (Michal Schmidt) [RHEL-15652] - idpf: refactor remaining virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor queue related virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor vport virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: implement virtchnl transaction manager (Michal Schmidt) [RHEL-15652] - idpf: add idpf_virtchnl.h (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler padding in virtchnl2_ptype struct (Michal Schmidt) [RHEL-15652] - idpf: distinguish vports by the dev_port attribute (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler introduced padding in virtchnl2_rss_key struct (Michal Schmidt) [RHEL-15652] - idpf: fix corrupted frames and skb leaks in singleq mode (Michal Schmidt) [RHEL-15652] - idpf: refactor some missing field get/prep conversions (Michal Schmidt) [RHEL-15652] - idpf: add get/set for Ethtool's header split ringparam (Michal Schmidt) [RHEL-15652] - idpf: fix potential use-after-free in idpf_tso() (Michal Schmidt) [RHEL-15652] - idpf: cancel mailbox work in error path (Michal Schmidt) [RHEL-15652] - idpf: set scheduling mode for completion queue (Michal Schmidt) [RHEL-15652] - idpf: add SRIOV support and other ndo_ops (Michal Schmidt) [RHEL-15652] - idpf: add ethtool callbacks (Michal Schmidt) [RHEL-15652] - idpf: add singleq start_xmit and napi poll (Michal Schmidt) [RHEL-15652] - idpf: add RX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add TX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add splitq start_xmit (Michal Schmidt) [RHEL-15652] - idpf: initialize interrupts and enable vport (Michal Schmidt) [RHEL-15652] - idpf: configure resources for RX queues (Michal Schmidt) [RHEL-15652] - idpf: configure resources for TX queues (Michal Schmidt) [RHEL-15652] - idpf: add ptypes and MAC filter support (Michal Schmidt) [RHEL-15652] - idpf: add create vport and netdev configuration (Michal Schmidt) [RHEL-15652] - idpf: add core init and interrupt request (Michal Schmidt) [RHEL-15652] - idpf: add controlq init and reset checks (Michal Schmidt) [RHEL-15652] - idpf: add module register and probe functionality (Michal Schmidt) [RHEL-15652] - virtchnl: add virtchnl version 2 ops (Michal Schmidt) [RHEL-15652] - net: netdev_queue: netdev_txq_completed_mb(): fix wake condition (Michal Schmidt) [RHEL-15652] - net: piggy back on the memory barrier in bql when waking queues (Michal Schmidt) [RHEL-15652] - net: provide macros for commonly copied lockless queue stop/wake code (Michal Schmidt) [RHEL-15652] - [rt] build kernel-rt-4.18.0-552.1.1.rt7.342.el8_10 [RHEL-34640] - build: Update RTBZ for 8.10 z-stream builds (Denys Vlasenko) - redhat: set DIST to el8_10 and ZSTREAM to yes for 8.10 (Denys Vlasenko) - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (Prarit Bhargava) [RHEL-32590] {CVE-2021-47185} - net: mana: Fix Rx DMA datasize and skb_over_panic (Cathy Avery) [RHEL-32579] - RDMA/srpt: Support specifying the srpt_service_guid parameter (Kamal Heib) [RHEL-31710] {CVE-2024-26744} - RDMA/qedr: Fix qedr_create_user_qp error flow (Kamal Heib) [RHEL-31714] {CVE-2024-26743} - hwmon: (coretemp) Fix out-of-bounds memory access (David Arcari) [RHEL-31305] {CVE-2024-26664} - RDMA/irdma: Fix KASAN issue with tasklet (Kamal Heib) [RHEL-15776] - net: bridge: use DEV_STATS_INC() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: Fix unwanted sign extension in netdev_stats_to_stats64() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: add atomic_long_t to net_device_stats fields (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net/sched: act_ct: fix skb leak and crash on ooo frags (Xin Long) [RHEL-29467] {CVE-2023-52610} - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Jose Ignacio Tornos Martinez) [RHEL-28015] {CVE-2023-52528} - RDMA/core: Fix uninit-value access in ib_get_eth_speed() (Kamal Heib) [RHEL-30130] - RDMA/core: Get IB width and speed from netdev (Kamal Heib) [RHEL-30130] - cpufreq: intel_pstate: Add Emerald Rapids support in no-HWP mode (Prarit Bhargava) [RHEL-29444] - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add (Mamatha Inamdar) [RHEL-29118] {CVE-2023-52607} - powerpc/lib: Validate size for vector operations (Mamatha Inamdar) [RHEL-29114] {CVE-2023-52606} - usb: hub: Guard against accesses to uninitialized BOS descriptors (Desnes Nunes) [RHEL-28986] {CVE-2023-52477} - media: uvcvideo: Fix OOB read (Desnes Nunes) [RHEL-27940] {CVE-2023-52565} - media: pvrusb2: fix use after free on context disconnection (Desnes Nunes) [RHEL-26498] {CVE-2023-52445} - i2c: i801: Fix block process call transactions (Prarit Bhargava) [RHEL-26478] {CVE-2024-26593} - overlay: disable EVM (Coiby Xu) [RHEL-19863] - evm: add support to disable EVM on unsupported filesystems (Coiby Xu) [RHEL-19863] - evm: don't copy up 'security.evm' xattr (Coiby Xu) [RHEL-19863] - net: ena: Remove ena_select_queue (Kamal Heib) [RHEL-14286] - media: dvbdev: Fix memory leak in dvb_media_device_free() (Prarit Bhargava) [RHEL-27254] {CVE-2020-36777} - gfs2: Fix invalid metadata access in punch_hole (Andrew Price) [RHEL-28784] - i2c: Fix a potential use after free (Prarit Bhargava) [RHEL-26849] {CVE-2019-25162} - i2c: validate user data in compat ioctl (Prarit Bhargava) [RHEL-27022] {CVE-2021-46934} - platform/x86: think-lmi: Fix reference leak (Prarit Bhargava) [RHEL-28030] {CVE-2023-52520} - vhost: use kzalloc() instead of kmalloc() followed by memset() (Jon Maloy) [RHEL-21505] {CVE-2024-0340} - RDMA/siw: Fix connection failure handling (Kamal Heib) [RHEL-28042] {CVE-2023-52513} - vt: fix memory overlapping when deleting chars in the buffer (Waiman Long) [RHEL-27778 RHEL-27779] {CVE-2022-48627} - x86/fpu: Stop relying on userspace for info to fault in xsave buffer (Steve Best) [RHEL-26669] {CVE-2024-26603} - mptcp: fix double-free on socket dismantle (Davide Caratti) [RHEL-22773] {CVE-2024-26782} - crypto: akcipher - Disable signing and decryption (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: akcipher - default implementations for request callbacks (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: testmgr - split akcipher tests by a key type (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - workqueue: Warn when a rescuer could not be created (Waiman Long) [RHEL-22136] - RDMA/cma: Avoid GID lookups on iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/cma: Deduplicate error flow in cma_validate_port() (Benjamin Coddington) [RHEL-12456] - RDMA/core: Set gid_attr.ndev for iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/siw: Fabricate a GID on tun and loopback devices (Benjamin Coddington) [RHEL-12456] - eventpoll: fix missing wakeup for ovflist in ep_poll_callback (Luis Claudio R. Goncalves) [RHEL-23022] - [rt] build kernel-rt-4.18.0-552.rt7.341.el8 [RHEL-5332] - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248] - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248] - [rt] build kernel-rt-4.18.0-551.rt7.340.el8 [RHEL-5332] - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742} - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992] - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825} - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237] - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724} - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513} - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921] - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921] - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921] - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921] - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921] - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774] - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660] - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660] - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199] - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539} - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825} - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237] - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724} - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513} - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921] - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921] - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921] - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921] - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921] - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285} - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993} - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396] - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396] - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396] - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396] - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355] - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355] - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355] - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355] - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355] - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355] - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240} - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek) - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963] - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171] - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171] - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226] - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226] - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744] - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744] - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744] - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744] - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew) [RHEL-129945] - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774] - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660] - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660] - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199] - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539} - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825} - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237] - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724} - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513} - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921] - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921] - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921] - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921] - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921] - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301} - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933} - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051} - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449] - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096} - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285} - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993} - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396] - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396] - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396] - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396] - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355] - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355] - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355] - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355] - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355] - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355] - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240} - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek) - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963] - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171] - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171] - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226] - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226] - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744] - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744] - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744] - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744] - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew) [RHEL-129945] - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774] - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660] - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660] - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199] - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539} - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - Bluetooth: hci_event: call disconnect callback before deleting conn (CKI Backport Bot) [RHEL-137039] {CVE-2023-53673} - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CKI Backport Bot) [RHEL-134423] {CVE-2025-40277} - xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 (John J Coleman) [RHEL-111354] - xen: Fix x86 sched_clock() interface for xen (John J Coleman) [RHEL-111354] - x86/xen/time: Output xen sched_clock time from 0 (John J Coleman) [RHEL-111354] - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Olga Kornievskaia) [RHEL-132819] - vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139273] {CVE-2025-40248} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ignore ndlp rport mismatch in dev_loss_tmo callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Modify handling of ADISC based on ndlp state and RPI registration (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Delete NLP_TARGET_REMOVE flag due to obsolete usage (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo callback (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Check devloss callbk done flag for potential stale NDLP ptrs (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kref imbalance on fabric ndlps from dev_loss_tmo handler (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Update PRLO handling in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Add condition to delete ndlp object after sending BLS_RJT to an ABTS (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove NLP_RCV_PLOGI early return during RSCN processing for ndlps (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Allow lpfc_plogi_confirm_nport() logic to execute for Fabric nodes (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix list_entry null check warning in lpfc_cmpl_els_plogi() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix possible file string name overflow when updating firmware (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Validate ELS LS_ACC completion payload (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove extra ndlp kref decrement in FLOGI cmpl for loop topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Revise NPIV ELS unsol rcv cmpl logic to drop ndlp based on nlp_state (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix double free in lpfc_cmpl_els_logo_acc() caused by lpfc_nlp_not_used() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Move scsi_host_template outside dynamically allocated/freed phba (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fill in missing ndlp kref puts in error paths (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login (Ewan D. Milne) [RHEL-32324] - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301} - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933} - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051} - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449] - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096} - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285} - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993} - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396] - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396] - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396] - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396] - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355] - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355] - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355] - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355] - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355] - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355] - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240} - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek) - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963] - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171] - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171] - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226] - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226] - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744] - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744] - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744] - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744] - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew) [RHEL-129945] - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117] - [rt] build kernel-rt-4.18.0-552.rt7.341.el8 [RHEL-5332] - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248] - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248] - [rt] build kernel-rt-4.18.0-551.rt7.340.el8 [RHEL-5332] - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742} - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992] - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992] - [rt] build kernel-rt-4.18.0-550.rt7.339.el8 [RHEL-5332] - mm/sparsemem: fix race in accessing memory_section->usage (Waiman Long) [RHEL-28875 RHEL-28876] {CVE-2023-52489} - mm: use __pfn_to_section() instead of open coding it (Waiman Long) [RHEL-28875] {CVE-2023-52489} - [rt] build kernel-rt-4.18.0-549.rt7.338.el8 [RHEL-5332] - dm-integrity: align the outgoing bio in integrity_recheck (Benjamin Marzinski) [RHEL-29678] - dm-integrity: fix a memory leak when rechecking the data (Benjamin Marzinski) [RHEL-29678] - RDMA/mana_ib: Add CQ interrupt support for RAW QP (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: query device capabilities (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: register RDMA device with GDMA (Maxim Levitsky) [RHEL-23934] - net: mana: add msix index sharing between EQs (Maxim Levitsky) [RHEL-23934] - net: mana: Fix spelling mistake "enforecement" -> "enforcement" (Maxim Levitsky) [RHEL-23934] - net :mana :Add remaining GDMA stats for MANA to ethtool (Maxim Levitsky) [RHEL-23934] - net: mana: Fix oversized sge0 for GSO packets (Maxim Levitsky) [RHEL-23934] - net: mana: Fix TX CQE error handling (Maxim Levitsky) [RHEL-23934] - net: mana: Add gdma stats to ethtool output for mana (Maxim Levitsky) [RHEL-23934] - net: mana: Fix MANA VF unload when hardware is unresponsive (Maxim Levitsky) [RHEL-23934] - net: mana: Configure hwc timeout from hardware (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (Maxim Levitsky) [RHEL-23934] - [rt] build kernel-rt-4.18.0-548.rt7.337.el8 [RHEL-5332] - gitlab-ci: enable arm64/s390x/ppc64le debug builds (Michael Hofmann) - arm64: Add missing bits of AmpereOne Spectre-BHB mitigation (Mark Salter) [RHEL-29005] - [rt] enable CONFIG_DRM_MGAG200_IOBURST_WORKAROUND (Jocelyn Falempe) [RHEL-13214] - drm/mgag200: Add a workaround for low-latency (Jocelyn Falempe) [RHEL-13214] - [rt] build kernel-rt-4.18.0-547.rt7.336.el8 [RHEL-5332] - x86/efistub: Avoid placing the kernel below LOAD_PHYSICAL_ADDR (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Give up if memory attribute protocol returns an error (Lenny Szubowicz) [RHEL-2505] - x86/boot: Increase section and file alignment to 4k/512 (Lenny Szubowicz) [RHEL-2505] - x86/boot: Split off PE/COFF .data section (Lenny Szubowicz) [RHEL-2505] - x86/boot: Drop PE/COFF .reloc section (Lenny Szubowicz) [RHEL-2505] - x86/boot: Construct PE/COFF .text section from assembler (Lenny Szubowicz) [RHEL-2505] - x86/boot: Derive file size from _edata symbol (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed: Remove, discard, or assert for unwanted sections (Lenny Szubowicz) [RHEL-2505] - x86/boot: Check that there are no run-time relocations (Lenny Szubowicz) [RHEL-2505] - x86/boot: Discard .discard.unreachable for arch/x86/boot/compressed/vmlinux (Lenny Szubowicz) [RHEL-2505] - x86/boot: Define setup size in linker script (Lenny Szubowicz) [RHEL-2505] - x86/boot: Set EFI handover offset directly in header asm (Lenny Szubowicz) [RHEL-2505] - x86/boot: Drop references to startup_64 (Lenny Szubowicz) [RHEL-2505] - x86/boot: Drop redundant code setting the root device (Lenny Szubowicz) [RHEL-2505] - x86/build: Declutter the build output (Lenny Szubowicz) [RHEL-2505] - x86/boot: Omit compression buffer from PE/COFF image memory footprint (Lenny Szubowicz) [RHEL-2505] - x86/boot: Mark global variables as static (Lenny Szubowicz) [RHEL-2505] - efi/x86: Remove extra headroom for setup block (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove the 'bugger off' message (Lenny Szubowicz) [RHEL-2505] - x86/efi: Drop alignment flags from PE section headers (Lenny Szubowicz) [RHEL-2505] - efi: Put Linux specific magic number in the DOS header (Lenny Szubowicz) [RHEL-2505] - efi/x86: Fix the missing KASLR_FLAG bit in boot_params->hdr.loadflags (Lenny Szubowicz) [RHEL-2505] - efi/x86: Avoid physical KASLR on older Dell systems (Lenny Szubowicz) [RHEL-2505] - x86/boot: efistub: Assign global boot_params variable (Lenny Szubowicz) [RHEL-2505] - x86/boot: Rename conflicting 'boot_params' pointer to 'boot_params_ptr' (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Avoid legacy decompressor when doing EFI boot (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Perform SNP feature test while running in the firmware (Lenny Szubowicz) [RHEL-2505] - x86/sev: Do not try to parse for the CC blob on non-AMD hardware (Lenny Szubowicz) [RHEL-2505] - efi/libstub: Add limit argument to efi_random_alloc() (Lenny Szubowicz) [RHEL-2505] - arm64: efi: Limit allocations to 48-bit addressable physical region (Lenny Szubowicz) [RHEL-2505] - efi: libstub: use EFI_LOADER_CODE region when moving the kernel in memory (Lenny Szubowicz) [RHEL-2505] - arm64: efi: kaslr: Fix occasional random alloc (and boot) failure (Lenny Szubowicz) [RHEL-2505] - efi/libstub/random: Increase random alloc granularity (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Factor out kernel decompression and relocation (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Move global symbol references to C code (Lenny Szubowicz) [RHEL-2505] - decompress: Use 8 byte alignment (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Prefer EFI memory attributes protocol over DXE services (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Perform 4/5 level paging switch from the stub (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Merge trampoline cleanup with switching code (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Pass pgtable address to trampoline directly (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Only call the trampoline when changing paging levels (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Call trampoline directly from C code (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Avoid the need for a stack in the 32-bit trampoline (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Use standard calling convention for trampoline (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Call trampoline as a normal function (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Remove .bss/.pgtable from bzImage (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove run-time relocations from .head.text code (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Assign paging related global variables earlier (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Store boot_params pointer in callee save register (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Clear BSS in EFI handover protocol entrypoint (Lenny Szubowicz) [RHEL-2505] - x86/head_64: Store boot_params pointer in callee save register (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Don't rely on upper 32 bits of GPRs being preserved (Lenny Szubowicz) [RHEL-2505] - x86/head/64: Switch to KERNEL_CS as soon as new GDT is installed (Lenny Szubowicz) [RHEL-2505] - efi/libstub: Add memory attribute protocol definitions (Lenny Szubowicz) [RHEL-2505] - efi/x86: libstub: remove unused variable (Lenny Szubowicz) [RHEL-2505] - x86/boot: Robustify calling startup_{32,64}() from the decompressor code (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Simplify and clean up handover entry code (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Branch straight to kernel entry point from C code (Lenny Szubowicz) [RHEL-2505] - efi/x86: Avoid using code32_start (Lenny Szubowicz) [RHEL-2505] - efi/libstub/x86: Use Exit() boot service to exit the stub on errors (Lenny Szubowicz) [RHEL-2505] - efi: x86: Wipe setup_data on pure EFI boot (Lenny Szubowicz) [RHEL-2505] - efi: x86: Fix config name for setting the NX-compatibility flag in the PE header (Lenny Szubowicz) [RHEL-2505] - efi: x86: Set the NX-compatibility flag in the PE header (Lenny Szubowicz) [RHEL-2505] - efi/x86: Add kernel preferred address to PE header (Lenny Szubowicz) [RHEL-2505] - efi/x86: Use symbolic constants in PE header instead of bare numbers (Lenny Szubowicz) [RHEL-2505] - efi/x86: Drop redundant .bss section (Lenny Szubowicz) [RHEL-2505] - efi/x86: add headroom to decompressor BSS to account for setup block (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove run-time relocations from head_{32,64}.S (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed: Fix debug_puthex() parameter type (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Use 32-bit (zero-extended) MOV for z_output_len (Lenny Szubowicz) [RHEL-2505] - x86/boot: Use unsigned comparison for addresses (Lenny Szubowicz) [RHEL-2505] - x86/boot: Micro-optimize GDT loading instructions (Lenny Szubowicz) [RHEL-2505] - x86/boot: GDT limit value should be size - 1 (Lenny Szubowicz) [RHEL-2505] - efi/x86: Remove GDT setup from efi_main (Lenny Szubowicz) [RHEL-2505] - x86/boot: Clear direction and interrupt flags in startup_64 (Lenny Szubowicz) [RHEL-2505] - efi/x86: Don't depend on firmware GDT layout (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove KEEP_SEGMENTS support (Lenny Szubowicz) [RHEL-2505] - x86/boot: Handle malformed SRAT tables during early ACPI parsing (Lenny Szubowicz) [RHEL-2505] - efi/libstub/x86: Use mandatory 16-byte stack alignment in mixed mode (Lenny Szubowicz) [RHEL-2505] - efi/libstub/x86: Avoid globals to store context during mixed mode calls (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Disable paging at mixed mode entry (Lenny Szubowicz) [RHEL-2505] - x86: efi/random: Invoke EFI_RNG_PROTOCOL to seed the UEFI RNG table (Lenny Szubowicz) [RHEL-2505] - x86/asm: Make some functions local (Lenny Szubowicz) [RHEL-2505] - x86/boot: Annotate data appropriately (Lenny Szubowicz) [RHEL-2505] - x86/boot: Annotate local functions (Lenny Szubowicz) [RHEL-2505] - x86/asm: Make more symbols local (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Fix missing initialization in find_trampoline_placement() (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Fix boot on machines with broken E820 table (Lenny Szubowicz) [RHEL-2505] - x86, boot: Remove multiple copy of static function sanitize_boot_params() (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Remove unused variable (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Explain paging_prepare()'s return value (Lenny Szubowicz) [RHEL-2505] - x86/boot: Save several bytes in decompressor (Lenny Szubowicz) [RHEL-2505] - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (Audra Mitchell) [RHEL-20614] {CVE-2024-0841} - net/gve: update check for little-endianness in gve kconfig (Joshua Washington) [RHEL-29030] - [rt] build kernel-rt-4.18.0-546.rt7.335.el8 [RHEL-5332] - sched/membarrier: reduce the ability to hammer on sys_membarrier (Wander Lairson Costa) [RHEL-23430] {CVE-2024-26602} - NFS: Set the stable writes flag when initialising the super block (Benjamin Coddington) [RHEL-25266] - smb: client: fix OOB in receive_encrypted_standard() (Scott Mayhew) [RHEL-21685] {CVE-2024-0565} - scsi: core: Move scsi_host_busy() out of host lock if it is for per-command (Ming Lei) [RHEL-23942] - scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler (Ming Lei) [RHEL-23942] - gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump (Andrew Price) [RHEL-26501] {CVE-2023-52448} - smb: client: fix parsing of SMB3.1.1 POSIX create context (Paulo Alcantara) [RHEL-26241] {CVE-2023-52434} - smb: client: fix potential OOBs in smb2_parse_contexts() (Paulo Alcantara) [RHEL-26241] {CVE-2023-52434} - smb3: Replace smb2pdu 1-element arrays with flex-arrays (Jay Shin) [RHEL-22143] - cifs: Replace remaining 1-element arrays (Jay Shin) [RHEL-22143] - cifs: Convert struct fealist away from 1-element array (Jay Shin) [RHEL-22143] - cifs: remove unneeded 2bytes of padding from smb2 tree connect (Jay Shin) [RHEL-22143] - cifs: Replace zero-length arrays with flexible-array members (Jay Shin) [RHEL-22143] - cifs: Replace a couple of one-element arrays with flexible-array members (Jay Shin) [RHEL-22143] - cifs: fix FILE_BOTH_DIRECTORY_INFO definition (Jay Shin) [RHEL-22143] - nfsd: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - nfs: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - lockd: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - cifs: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - ceph: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - filelock: add a new locks_inode_context accessor function (Jeffrey Layton) [RHEL-27441] - dm-integrity, dm-verity: reduce stack usage for recheck (Benjamin Marzinski) [RHEL-27849] - dm-crypt: recheck the integrity tag after a failure (Benjamin Marzinski) [RHEL-27849] - dm-crypt: don't modify the data when using authenticated encryption (Benjamin Marzinski) [RHEL-27849] - dm-verity: recheck the hash after a failure (Benjamin Marzinski) [RHEL-27849] - dm-integrity: recheck the integrity tag after a failure (Benjamin Marzinski) [RHEL-27849] - [rt] build kernel-rt-4.18.0-545.rt7.334.el8 [RHEL-5332] - tracing/timerlat: Move hrtimer_init to timerlat_fd open() (John Kacur) [RHEL-26667] - tracing/perf: Fix double put of trace event when init fails (Michael Petlan) [RHEL-19537] - ipvlan: Add handling of NETDEV_UP events (Hangbin Liu) [RHEL-19098] - ceph: add ceph_cap_unlink_work to fire check_caps() immediately (Xiubo Li) [RHEL-21760] - ceph: always queue a writeback when revoking the Fb caps (Xiubo Li) [RHEL-21760] - ceph: always check dir caps asynchronously (Xiubo Li) [RHEL-21760] - nfs: fix redundant readdir request after get eof (Benjamin Coddington) [RHEL-7780] - NFSv4.1: fixup use EXCHGID4_FLAG_USE_PNFS_DS for DS server (Scott Mayhew) [RHEL-7994] - NFSv4.1: fix pnfs MDS=DS session trunking (Scott Mayhew) [RHEL-7994] - NFSv4.1: fix zero value filehandle in post open getattr (Scott Mayhew) [RHEL-7994] - NFSv4.1: use EXCHGID4_FLAG_USE_PNFS_DS for DS server (Scott Mayhew) [RHEL-7994] - x86/boot: Ignore NMIs during very early boot (Valentin Schneider) [RHEL-22749] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - vfs: use READ_ONCE() to access ->i_link (Jay Shin) [RHEL-141790] - fold generic_readlink() into its only caller (Jay Shin) [RHEL-141790] - fs/proc: fix uaf in proc_readdir_de() (Pavel Reichl) [RHEL-137093] {CVE-2025-40271} - Backport 'create an empty changelog file when changing its name' (Alexandra Hájková) - mptcp: fix race condition in mptcp_schedule_work() (Paolo Abeni) [RHEL-134443] {CVE-2025-40258} - mptcp: use mptcp_schedule_work instead of open-coding it (Paolo Abeni) [RHEL-134443] - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - tcp: minor optimization in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Kamal Heib) [RHEL-134347] {CVE-2025-38022} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - Bluetooth: hci_event: call disconnect callback before deleting conn (CKI Backport Bot) [RHEL-137039] {CVE-2023-53673} - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CKI Backport Bot) [RHEL-134423] {CVE-2025-40277} - xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 (John J Coleman) [RHEL-111354] - xen: Fix x86 sched_clock() interface for xen (John J Coleman) [RHEL-111354] - x86/xen/time: Output xen sched_clock time from 0 (John J Coleman) [RHEL-111354] - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Olga Kornievskaia) [RHEL-132819] - vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139273] {CVE-2025-40248} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ignore ndlp rport mismatch in dev_loss_tmo callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Modify handling of ADISC based on ndlp state and RPI registration (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Delete NLP_TARGET_REMOVE flag due to obsolete usage (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo callback (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Check devloss callbk done flag for potential stale NDLP ptrs (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kref imbalance on fabric ndlps from dev_loss_tmo handler (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Update PRLO handling in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Add condition to delete ndlp object after sending BLS_RJT to an ABTS (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove NLP_RCV_PLOGI early return during RSCN processing for ndlps (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Allow lpfc_plogi_confirm_nport() logic to execute for Fabric nodes (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix list_entry null check warning in lpfc_cmpl_els_plogi() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix possible file string name overflow when updating firmware (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Validate ELS LS_ACC completion payload (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove extra ndlp kref decrement in FLOGI cmpl for loop topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Revise NPIV ELS unsol rcv cmpl logic to drop ndlp based on nlp_state (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix double free in lpfc_cmpl_els_logo_acc() caused by lpfc_nlp_not_used() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Move scsi_host_template outside dynamically allocated/freed phba (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fill in missing ndlp kref puts in error paths (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login (Ewan D. Milne) [RHEL-32324] - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301} - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933} - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051} - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449] - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096} - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - vfs: use READ_ONCE() to access ->i_link (Jay Shin) [RHEL-141790] - fold generic_readlink() into its only caller (Jay Shin) [RHEL-141790] - fs/proc: fix uaf in proc_readdir_de() (Pavel Reichl) [RHEL-137093] {CVE-2025-40271} - Backport 'create an empty changelog file when changing its name' (Alexandra Hájková) - mptcp: fix race condition in mptcp_schedule_work() (Paolo Abeni) [RHEL-134443] {CVE-2025-40258} - mptcp: use mptcp_schedule_work instead of open-coding it (Paolo Abeni) [RHEL-134443] - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - tcp: minor optimization in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Kamal Heib) [RHEL-134347] {CVE-2025-38022} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - vfs: use READ_ONCE() to access ->i_link (Jay Shin) [RHEL-141790] - fold generic_readlink() into its only caller (Jay Shin) [RHEL-141790] - fs/proc: fix uaf in proc_readdir_de() (Pavel Reichl) [RHEL-137093] {CVE-2025-40271} - Backport 'create an empty changelog file when changing its name' (Alexandra Hájková) - mptcp: fix race condition in mptcp_schedule_work() (Paolo Abeni) [RHEL-134443] {CVE-2025-40258} - mptcp: use mptcp_schedule_work instead of open-coding it (Paolo Abeni) [RHEL-134443] - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - tcp: minor optimization in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Kamal Heib) [RHEL-134347] {CVE-2025-38022} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - autofs: use wake_up() instead of wake_up_interruptible(() (Ian Kent) [RHEL-143685] - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Ian Kent) [RHEL-143685] {CVE-2023-54134} - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141709] - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-136693] - audit: merge loops in __audit_inode_child() (Ricardo Robaina) [RHEL-140442] - bridge: mcast: Fix use-after-free during router port configuration (Mohammad Heib) [RHEL-138422] {CVE-2025-38248} - net/sched: Enforce that teql can only be used as root qdisc (CKI Backport Bot) [RHEL-146992] {CVE-2026-23074} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Marc Milgram) [RHEL-137838] {CVE-2025-38129} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143189] {CVE-2025-68800} - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126886] {CVE-2025-40064} - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147261] {CVE-2026-23097} - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-134673] - autofs: use wake_up() instead of wake_up_interruptible(() (Ian Kent) [RHEL-143685] - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Ian Kent) [RHEL-143685] {CVE-2023-54134} - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141709] - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-136693] - audit: merge loops in __audit_inode_child() (Ricardo Robaina) [RHEL-140442] - bridge: mcast: Fix use-after-free during router port configuration (Mohammad Heib) [RHEL-138422] {CVE-2025-38248} - net/sched: Enforce that teql can only be used as root qdisc (CKI Backport Bot) [RHEL-146992] {CVE-2026-23074} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Marc Milgram) [RHEL-137838] {CVE-2025-38129} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143189] {CVE-2025-68800} - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126886] {CVE-2025-40064} - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - macvlan: fix possible UAF in macvlan_forward_source() (Hangbin Liu) [RHEL-144120] {CVE-2026-23001} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-131922] - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount (Jocelyn Falempe) [RHEL-148636] - audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd references (Waiman Long) [RHEL-146026] - fs: Add a pool of extra fs->pwd references to fs_struct (Waiman Long) [RHEL-146026] - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143535] {CVE-2025-71085} - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147261] {CVE-2026-23097} - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-134673] - autofs: use wake_up() instead of wake_up_interruptible(() (Ian Kent) [RHEL-143685] - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Ian Kent) [RHEL-143685] {CVE-2023-54134} - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141709] - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-136693] - audit: merge loops in __audit_inode_child() (Ricardo Robaina) [RHEL-140442] - bridge: mcast: Fix use-after-free during router port configuration (Mohammad Heib) [RHEL-138422] {CVE-2025-38248} - net/sched: Enforce that teql can only be used as root qdisc (CKI Backport Bot) [RHEL-146992] {CVE-2026-23074} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Marc Milgram) [RHEL-137838] {CVE-2025-38129} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143189] {CVE-2025-68800} - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126886] {CVE-2025-40064} - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - x86/microcode/AMD: Revert "Backport AMD microcode commits for better microcode loading support" (Waiman Long) [RHEL-155860] - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150398] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150398] - tcp: fix forever orphan socket caused by tcp_abort (Paolo Abeni) [RHEL-146187] - xfs: fix minimum agno handling for xfs alloc modes in RHEL8 (Brian Foster) [RHEL-102464] - xfs: fix uninitialized use of flags variable in xfs_alloc_vextent() (Brian Foster) [RHEL-102464] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82523] - tcp: use this_cpu_read(*X) instead of *this_cpu_ptr(X) (Davide Caratti) [RHEL-82523] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150221] - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150221] {CVE-2026-23209} - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) [RHEL-96016] - s390/kexec: Emit an error message when cmdline is too long (Mete Durlu) [RHEL-144946] - s390/boot: Fix kernel size in bootparm area (Mete Durlu) [RHEL-144946] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-137123] - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-151614] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove useless transaction in evict_linked_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-151614] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-151614] - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146419] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146419] {CVE-2025-38323} - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136288] - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136288] - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136288] - scsi: st: Tighten the page format heuristics with MODE SELECT (John Meneghini) [RHEL-136288] - scsi: st: ERASE does not change tape location (John Meneghini) [RHEL-136288] - scsi: st: Fix array overflow in st_setup() (John Meneghini) [RHEL-136288] - scsi: st: Add sysfs file position_lost_in_reset (John Meneghini) [RHEL-136288] - scsi: st: Modify st.c to use the new scsi_error counters (John Meneghini) [RHEL-136288] - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (John Meneghini) [RHEL-136288] - scsi: st: Restore some drive settings after reset (John Meneghini) [RHEL-136288] - scsi: st: Fix input/output error on empty drive reset (John Meneghini) [RHEL-136288] - smb: client: handle lack of IPC in dfs_cache_refresh() (Paulo Alcantara) [RHEL-138235] - smb: client: allow parsing zero-length AV pairs (Paulo Alcantara) [RHEL-138235] - cifs: reduce warning log level for server not advertising interfaces (Paulo Alcantara) [RHEL-138235] - smb: client: Fix match_session bug preventing session reuse (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of kstrdup() in get_ses_refpath() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy when tree connecting to DFS interlink targets (Paulo Alcantara) [RHEL-138235] - smb: client: don't trust DFSREF_STORAGE_SERVER bit (Paulo Alcantara) [RHEL-138235] - smb: client: don't check for @leaf_fullpath in match_server() (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of TCP_Server_Info::refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: don't retry DFS targets on server shutdown (Paulo Alcantara) [RHEL-138235] - smb: client: fix return value of parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: optimize referral walk on failed link targets (Paulo Alcantara) [RHEL-138235] - smb: client: provide dns_resolve_{unc,name} helpers (Paulo Alcantara) [RHEL-138235] - smb: client: parse DNS domain name from domain= option (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS mount against old servers with NTLMSSP (Paulo Alcantara) [RHEL-138235] - smb: client: parse av pair type 4 in CHALLENGE_MESSAGE (Paulo Alcantara) [RHEL-138235] - smb: client: introduce av_for_each_entry() helper (Paulo Alcantara) [RHEL-138235] - smb: client: fix double free of TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-138235] {CVE-2025-21673} - smb: client: fix potential race in cifs_put_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy message when mounting shares (Paulo Alcantara) [RHEL-138235] - smb: client: don't try following DFS links in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow reconnect when sending ioctl (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of @nlsc param in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow more DFS referrals to be cached (Paulo Alcantara) [RHEL-138235] - smb: client: propagate error from cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS failover in multiuser mounts (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS interlink failover (Paulo Alcantara) [RHEL-138235] - smb: client: improve purging of cached referrals (Paulo Alcantara) [RHEL-138235] - smb: client: avoid unnecessary reconnects when refreshing referrals (Paulo Alcantara) [RHEL-138235] - smb: client: serialise cifs_construct_tcon() with cifs_mount_mutex (Paulo Alcantara) [RHEL-138235] - smb: client: handle DFS tcons in cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: refresh referral without acquiring refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: guarantee refcounted children from parent session (Paulo Alcantara) [RHEL-138235] {CVE-2024-35869} - smb: client: set correct id, uid and cruid for multiuser automounts (Paulo Alcantara) [RHEL-138235] {CVE-2024-26822} - cifs: change tcon status when need_reconnect is set on it (Paulo Alcantara) [RHEL-138235] - smb: client: fix potential NULL deref in parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: fix mount when dns_resolver key is not available (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs code dep in namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs naming in automount code (Paulo Alcantara) [RHEL-138235] - smb: client: rename cifs_dfs_ref.c to namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: ensure to try all targets when finding nested links (Paulo Alcantara) [RHEL-138235] - smb: client: introduce DFS_CACHE_TGT_LIST() (Paulo Alcantara) [RHEL-138235] - smb: client: fix null auth (Paulo Alcantara) [RHEL-138235] - smb: client: fix dfs link mount against w2k8 (Paulo Alcantara) [RHEL-138235] - cifs: fix charset issue in reconnection (Paulo Alcantara) [RHEL-138235] - smb: client: fix missed ses refcounting (Paulo Alcantara) [RHEL-138235] {CVE-2023-54076} - fs/nls: make load_nls() take a const parameter (Paulo Alcantara) [RHEL-138235] - smb: client: remove redundant pointer 'server' (Paulo Alcantara) [RHEL-138235] - smb: client: improve DFS mount check (Paulo Alcantara) [RHEL-138235] - smb: client: fix shared DFS root mounts with different prefixes (Paulo Alcantara) [RHEL-138235] - smb: client: fix parsing of source mount option (Paulo Alcantara) [RHEL-138235] - smb: client: fix warning in cifs_match_super() (Paulo Alcantara) [RHEL-138235] - cifs: fix max_credits implementation (Paulo Alcantara) [RHEL-138235] - cifs: fix sockaddr comparison in iface_cmp (Paulo Alcantara) [RHEL-138235] - cifs: fix status checks in cifs_tree_connect (Paulo Alcantara) [RHEL-138235] - cifs: fix smb1 mount regression (Paulo Alcantara) [RHEL-138235] - cifs: fix sharing of DFS connections (Paulo Alcantara) [RHEL-138235] - cifs: avoid potential races when handling multiple dfs tcons (Paulo Alcantara) [RHEL-138235] - cifs: protect access of TCP_Server_Info::{origin,leaf}_fullpath (Paulo Alcantara) [RHEL-138235] - cifs: avoid dup prefix path in dfs_get_automount_devname() (Paulo Alcantara) [RHEL-138235] - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL (Paulo Alcantara) [RHEL-138235] {CVE-2023-53246} - smb3: fix unusable share after force unmount failure (Paulo Alcantara) [RHEL-138235] - cifs: check only tcon status on tcon related functions (Paulo Alcantara) [RHEL-138235] - cifs: return DFS root session id in DebugData (Paulo Alcantara) [RHEL-138235] - cifs: fix use-after-free bug in refresh_cache_worker() (Paulo Alcantara) [RHEL-138235] {CVE-2023-53052} - cifs: set DFS root session in cifs_get_smb_ses() (Paulo Alcantara) [RHEL-138235] - cifs: remove unused function (Paulo Alcantara) [RHEL-138235] - cifs: remove duplicate code in __refresh_tcon() (Paulo Alcantara) [RHEL-138235] - cifs: remove redundant assignment to the variable match (Paulo Alcantara) [RHEL-138235] - cifs: use origin fullpath for automounts (Paulo Alcantara) [RHEL-138235] - cifs: fix source pathname comparison of dfs supers (Paulo Alcantara) [RHEL-138235] - cifs: fix confusing debug message (Paulo Alcantara) [RHEL-138235] - cifs: don't block in dfs_cache_noreq_update_tgthint() (Paulo Alcantara) [RHEL-138235] - cifs: refresh root referrals (Paulo Alcantara) [RHEL-138235] - cifs: fix refresh of cached referrals (Paulo Alcantara) [RHEL-138235] - cifs: share dfs connections and supers (Paulo Alcantara) [RHEL-138235] - cifs: split out ses and tcon retrieval from mount_get_conns() (Paulo Alcantara) [RHEL-138235] - cifs: set resolved ip in sockaddr (Paulo Alcantara) [RHEL-138235] - cifs: remove unused smb3_fs_context::mount_options (Paulo Alcantara) [RHEL-138235] - cifs: get rid of mount options string parsing (Paulo Alcantara) [RHEL-138235] - cifs: use fs_context for automounts (Paulo Alcantara) [RHEL-138235] - cifs: remove various function description warnings (Paulo Alcantara) [RHEL-138235] - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Select which microcode patch to load (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add more known models to entry sign checking (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Limit Entrysign signature checking to known generations (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use sha256() instead of init/update/final (Waiman Long) [RHEL-132479] - x86/microcode: Fix Entrysign revision check for Zen1/Naples (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Handle the case of no BIOS microcode (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add some forgotten models to the SHA check (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Load only SHA256-checksummed patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add get_patch_level() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Merge early_apply_microcode() into its single callsite (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Have __apply_microcode_amd() return bool (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Flush patch buffer mapping after application (Waiman Long) [RHEL-132479] - x86/mm: Carve out INVLPG inline asm for use by others (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Split load_microcode_amd() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Pay attention to the stepping dynamically (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix a -Wsometimes-uninitialized clang false positive (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use the family,model,stepping encoded in the patch ID (Waiman Long) [RHEL-132479] - x86/microcode/amd: Cache builtin microcode too (Waiman Long) [RHEL-132479] - x86/microcode/amd: Use correct per CPU ucode_cpu_info (Waiman Long) [RHEL-132479] - x86/microcode/amd: Remove X86_32 specific code in early_apply_microcode() & get_builtin_microcode() (Waiman Long) [RHEL-132479] - x86/microcode: Move core specific defines to local header (Waiman Long) [RHEL-132479] - x86/microcode/intel: Rename get_datasize() since its used externally (Waiman Long) [RHEL-132479] - x86/microcode: Make reload_early_microcode() static (Waiman Long) [RHEL-132479] - x86/microcode: Include vendor headers into microcode.h (Waiman Long) [RHEL-132479] - x86/microcode/intel: Move microcode functions out of cpu/intel.c (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Get rid of __find_equiv_id() (Waiman Long) [RHEL-132479] - x86/microcode: Add explicit CPU vendor dependency (Waiman Long) [RHEL-132479] - macvlan: fix possible UAF in macvlan_forward_source() (Hangbin Liu) [RHEL-144120] {CVE-2026-23001} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-131922] - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount (Jocelyn Falempe) [RHEL-148636] - audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd references (Waiman Long) [RHEL-146026] - fs: Add a pool of extra fs->pwd references to fs_struct (Waiman Long) [RHEL-146026] - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143535] {CVE-2025-71085} - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147261] {CVE-2026-23097} - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-134673] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930] - NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242] - pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242] - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242] - NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242] - NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242] - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242] - SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242] - NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242] - SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242] - SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242] - SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242] - SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242] - NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242] - NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419] - nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419] - pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419] - NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419] - NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419] - NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419] - NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419] - NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419] - NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419] - NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419] - NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419] - NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419] - nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419] - nfs: always check dreq->error after a commit (Mike Snitzer) [RHEL-156419] - nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419] - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231} - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942] - x86/microcode/AMD: Revert "Backport AMD microcode commits for better microcode loading support" (Waiman Long) [RHEL-155860] - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150398] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150398] - tcp: fix forever orphan socket caused by tcp_abort (Paolo Abeni) [RHEL-146187] - xfs: fix minimum agno handling for xfs alloc modes in RHEL8 (Brian Foster) [RHEL-102464] - xfs: fix uninitialized use of flags variable in xfs_alloc_vextent() (Brian Foster) [RHEL-102464] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82523] - tcp: use this_cpu_read(*X) instead of *this_cpu_ptr(X) (Davide Caratti) [RHEL-82523] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150221] - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150221] {CVE-2026-23209} - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) [RHEL-96016] - s390/kexec: Emit an error message when cmdline is too long (Mete Durlu) [RHEL-144946] - s390/boot: Fix kernel size in bootparm area (Mete Durlu) [RHEL-144946] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-137123] - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-151614] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove useless transaction in evict_linked_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-151614] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-151614] - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146419] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146419] {CVE-2025-38323} - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136288] - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136288] - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136288] - scsi: st: Tighten the page format heuristics with MODE SELECT (John Meneghini) [RHEL-136288] - scsi: st: ERASE does not change tape location (John Meneghini) [RHEL-136288] - scsi: st: Fix array overflow in st_setup() (John Meneghini) [RHEL-136288] - scsi: st: Add sysfs file position_lost_in_reset (John Meneghini) [RHEL-136288] - scsi: st: Modify st.c to use the new scsi_error counters (John Meneghini) [RHEL-136288] - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (John Meneghini) [RHEL-136288] - scsi: st: Restore some drive settings after reset (John Meneghini) [RHEL-136288] - scsi: st: Fix input/output error on empty drive reset (John Meneghini) [RHEL-136288] - smb: client: handle lack of IPC in dfs_cache_refresh() (Paulo Alcantara) [RHEL-138235] - smb: client: allow parsing zero-length AV pairs (Paulo Alcantara) [RHEL-138235] - cifs: reduce warning log level for server not advertising interfaces (Paulo Alcantara) [RHEL-138235] - smb: client: Fix match_session bug preventing session reuse (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of kstrdup() in get_ses_refpath() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy when tree connecting to DFS interlink targets (Paulo Alcantara) [RHEL-138235] - smb: client: don't trust DFSREF_STORAGE_SERVER bit (Paulo Alcantara) [RHEL-138235] - smb: client: don't check for @leaf_fullpath in match_server() (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of TCP_Server_Info::refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: don't retry DFS targets on server shutdown (Paulo Alcantara) [RHEL-138235] - smb: client: fix return value of parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: optimize referral walk on failed link targets (Paulo Alcantara) [RHEL-138235] - smb: client: provide dns_resolve_{unc,name} helpers (Paulo Alcantara) [RHEL-138235] - smb: client: parse DNS domain name from domain= option (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS mount against old servers with NTLMSSP (Paulo Alcantara) [RHEL-138235] - smb: client: parse av pair type 4 in CHALLENGE_MESSAGE (Paulo Alcantara) [RHEL-138235] - smb: client: introduce av_for_each_entry() helper (Paulo Alcantara) [RHEL-138235] - smb: client: fix double free of TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-138235] {CVE-2025-21673} - smb: client: fix potential race in cifs_put_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy message when mounting shares (Paulo Alcantara) [RHEL-138235] - smb: client: don't try following DFS links in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow reconnect when sending ioctl (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of @nlsc param in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow more DFS referrals to be cached (Paulo Alcantara) [RHEL-138235] - smb: client: propagate error from cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS failover in multiuser mounts (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS interlink failover (Paulo Alcantara) [RHEL-138235] - smb: client: improve purging of cached referrals (Paulo Alcantara) [RHEL-138235] - smb: client: avoid unnecessary reconnects when refreshing referrals (Paulo Alcantara) [RHEL-138235] - smb: client: serialise cifs_construct_tcon() with cifs_mount_mutex (Paulo Alcantara) [RHEL-138235] - smb: client: handle DFS tcons in cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: refresh referral without acquiring refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: guarantee refcounted children from parent session (Paulo Alcantara) [RHEL-138235] {CVE-2024-35869} - smb: client: set correct id, uid and cruid for multiuser automounts (Paulo Alcantara) [RHEL-138235] {CVE-2024-26822} - cifs: change tcon status when need_reconnect is set on it (Paulo Alcantara) [RHEL-138235] - smb: client: fix potential NULL deref in parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: fix mount when dns_resolver key is not available (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs code dep in namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs naming in automount code (Paulo Alcantara) [RHEL-138235] - smb: client: rename cifs_dfs_ref.c to namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: ensure to try all targets when finding nested links (Paulo Alcantara) [RHEL-138235] - smb: client: introduce DFS_CACHE_TGT_LIST() (Paulo Alcantara) [RHEL-138235] - smb: client: fix null auth (Paulo Alcantara) [RHEL-138235] - smb: client: fix dfs link mount against w2k8 (Paulo Alcantara) [RHEL-138235] - cifs: fix charset issue in reconnection (Paulo Alcantara) [RHEL-138235] - smb: client: fix missed ses refcounting (Paulo Alcantara) [RHEL-138235] {CVE-2023-54076} - fs/nls: make load_nls() take a const parameter (Paulo Alcantara) [RHEL-138235] - smb: client: remove redundant pointer 'server' (Paulo Alcantara) [RHEL-138235] - smb: client: improve DFS mount check (Paulo Alcantara) [RHEL-138235] - smb: client: fix shared DFS root mounts with different prefixes (Paulo Alcantara) [RHEL-138235] - smb: client: fix parsing of source mount option (Paulo Alcantara) [RHEL-138235] - smb: client: fix warning in cifs_match_super() (Paulo Alcantara) [RHEL-138235] - cifs: fix max_credits implementation (Paulo Alcantara) [RHEL-138235] - cifs: fix sockaddr comparison in iface_cmp (Paulo Alcantara) [RHEL-138235] - cifs: fix status checks in cifs_tree_connect (Paulo Alcantara) [RHEL-138235] - cifs: fix smb1 mount regression (Paulo Alcantara) [RHEL-138235] - cifs: fix sharing of DFS connections (Paulo Alcantara) [RHEL-138235] - cifs: avoid potential races when handling multiple dfs tcons (Paulo Alcantara) [RHEL-138235] - cifs: protect access of TCP_Server_Info::{origin,leaf}_fullpath (Paulo Alcantara) [RHEL-138235] - cifs: avoid dup prefix path in dfs_get_automount_devname() (Paulo Alcantara) [RHEL-138235] - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL (Paulo Alcantara) [RHEL-138235] {CVE-2023-53246} - smb3: fix unusable share after force unmount failure (Paulo Alcantara) [RHEL-138235] - cifs: check only tcon status on tcon related functions (Paulo Alcantara) [RHEL-138235] - cifs: return DFS root session id in DebugData (Paulo Alcantara) [RHEL-138235] - cifs: fix use-after-free bug in refresh_cache_worker() (Paulo Alcantara) [RHEL-138235] {CVE-2023-53052} - cifs: set DFS root session in cifs_get_smb_ses() (Paulo Alcantara) [RHEL-138235] - cifs: remove unused function (Paulo Alcantara) [RHEL-138235] - cifs: remove duplicate code in __refresh_tcon() (Paulo Alcantara) [RHEL-138235] - cifs: remove redundant assignment to the variable match (Paulo Alcantara) [RHEL-138235] - cifs: use origin fullpath for automounts (Paulo Alcantara) [RHEL-138235] - cifs: fix source pathname comparison of dfs supers (Paulo Alcantara) [RHEL-138235] - cifs: fix confusing debug message (Paulo Alcantara) [RHEL-138235] - cifs: don't block in dfs_cache_noreq_update_tgthint() (Paulo Alcantara) [RHEL-138235] - cifs: refresh root referrals (Paulo Alcantara) [RHEL-138235] - cifs: fix refresh of cached referrals (Paulo Alcantara) [RHEL-138235] - cifs: share dfs connections and supers (Paulo Alcantara) [RHEL-138235] - cifs: split out ses and tcon retrieval from mount_get_conns() (Paulo Alcantara) [RHEL-138235] - cifs: set resolved ip in sockaddr (Paulo Alcantara) [RHEL-138235] - cifs: remove unused smb3_fs_context::mount_options (Paulo Alcantara) [RHEL-138235] - cifs: get rid of mount options string parsing (Paulo Alcantara) [RHEL-138235] - cifs: use fs_context for automounts (Paulo Alcantara) [RHEL-138235] - cifs: remove various function description warnings (Paulo Alcantara) [RHEL-138235] - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Select which microcode patch to load (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add more known models to entry sign checking (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Limit Entrysign signature checking to known generations (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use sha256() instead of init/update/final (Waiman Long) [RHEL-132479] - x86/microcode: Fix Entrysign revision check for Zen1/Naples (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Handle the case of no BIOS microcode (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add some forgotten models to the SHA check (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Load only SHA256-checksummed patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add get_patch_level() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Merge early_apply_microcode() into its single callsite (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Have __apply_microcode_amd() return bool (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Flush patch buffer mapping after application (Waiman Long) [RHEL-132479] - x86/mm: Carve out INVLPG inline asm for use by others (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Split load_microcode_amd() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Pay attention to the stepping dynamically (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix a -Wsometimes-uninitialized clang false positive (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use the family,model,stepping encoded in the patch ID (Waiman Long) [RHEL-132479] - x86/microcode/amd: Cache builtin microcode too (Waiman Long) [RHEL-132479] - x86/microcode/amd: Use correct per CPU ucode_cpu_info (Waiman Long) [RHEL-132479] - x86/microcode/amd: Remove X86_32 specific code in early_apply_microcode() & get_builtin_microcode() (Waiman Long) [RHEL-132479] - x86/microcode: Move core specific defines to local header (Waiman Long) [RHEL-132479] - x86/microcode/intel: Rename get_datasize() since its used externally (Waiman Long) [RHEL-132479] - x86/microcode: Make reload_early_microcode() static (Waiman Long) [RHEL-132479] - x86/microcode: Include vendor headers into microcode.h (Waiman Long) [RHEL-132479] - x86/microcode/intel: Move microcode functions out of cpu/intel.c (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Get rid of __find_equiv_id() (Waiman Long) [RHEL-132479] - x86/microcode: Add explicit CPU vendor dependency (Waiman Long) [RHEL-132479] - macvlan: fix possible UAF in macvlan_forward_source() (Hangbin Liu) [RHEL-144120] {CVE-2026-23001} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-131922] - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount (Jocelyn Falempe) [RHEL-148636] - audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd references (Waiman Long) [RHEL-146026] - fs: Add a pool of extra fs->pwd references to fs_struct (Waiman Long) [RHEL-146026] - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143535] {CVE-2025-71085} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930] - NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242] - pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242] - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242] - NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242] - NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242] - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242] - SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242] - NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242] - SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242] - SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242] - SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242] - SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242] - NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242] - NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419] - nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419] - pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419] - NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419] - NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419] - NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419] - NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419] - NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419] - NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419] - NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419] - NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419] - NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419] - nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419] - nfs: always check dreq->error after a commit (Mike Snitzer) [RHEL-156419] - nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419] - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231} - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942] - x86/microcode/AMD: Revert "Backport AMD microcode commits for better microcode loading support" (Waiman Long) [RHEL-155860] - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150398] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150398] - tcp: fix forever orphan socket caused by tcp_abort (Paolo Abeni) [RHEL-146187] - xfs: fix minimum agno handling for xfs alloc modes in RHEL8 (Brian Foster) [RHEL-102464] - xfs: fix uninitialized use of flags variable in xfs_alloc_vextent() (Brian Foster) [RHEL-102464] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82523] - tcp: use this_cpu_read(*X) instead of *this_cpu_ptr(X) (Davide Caratti) [RHEL-82523] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150221] - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150221] {CVE-2026-23209} - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) [RHEL-96016] - s390/kexec: Emit an error message when cmdline is too long (Mete Durlu) [RHEL-144946] - s390/boot: Fix kernel size in bootparm area (Mete Durlu) [RHEL-144946] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-137123] - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-151614] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove useless transaction in evict_linked_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-151614] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-151614] - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146419] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146419] {CVE-2025-38323} - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136288] - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136288] - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136288] - scsi: st: Tighten the page format heuristics with MODE SELECT (John Meneghini) [RHEL-136288] - scsi: st: ERASE does not change tape location (John Meneghini) [RHEL-136288] - scsi: st: Fix array overflow in st_setup() (John Meneghini) [RHEL-136288] - scsi: st: Add sysfs file position_lost_in_reset (John Meneghini) [RHEL-136288] - scsi: st: Modify st.c to use the new scsi_error counters (John Meneghini) [RHEL-136288] - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (John Meneghini) [RHEL-136288] - scsi: st: Restore some drive settings after reset (John Meneghini) [RHEL-136288] - scsi: st: Fix input/output error on empty drive reset (John Meneghini) [RHEL-136288] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930] - NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242] - pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242] - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242] - NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242] - NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242] - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242] - SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242] - NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242] - SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242] - SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242] - SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242] - SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242] - NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242] - NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419] - nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419] - pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419] - NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419] - NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419] - NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419] - NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419] - NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419] - NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419] - NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419] - NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419] - NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419] - nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419] - nfs: always check dreq->error after a commit (Mike Snitzer) [RHEL-156419] - nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419] - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231} - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942] - xfrm: esp: avoid in-place decrypt on shared skb frags - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772] - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772] - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772] - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772] - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772] - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772] - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709} - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815] - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815] - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815] - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190} - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408} - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684} - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032] - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032] - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032] - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032] - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032] - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032] - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032] - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032] - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032] - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183} - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219] - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219] - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219] - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219] - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219] - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219] - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219] - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347} - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243} - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890] - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890] - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890] - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890] - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890] - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890] - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890] - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613} - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961] - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858} - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392} - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781} - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990} - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772] - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772] - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772] - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772] - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772] - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772] - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709} - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815] - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815] - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815] - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190} - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408} - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684} - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032] - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032] - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032] - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032] - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032] - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032] - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032] - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032] - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032] - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183} - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219] - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219] - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219] - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219] - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219] - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219] - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219] - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347} - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243} - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890] - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890] - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890] - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890] - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890] - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890] - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890] - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613} - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961] - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858} - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392} - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781} - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990} - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772] - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772] - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772] - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772] - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772] - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772] - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709} - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815] - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815] - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815] - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190} - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408} - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684} - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032] - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032] - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032] - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032] - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032] - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032] - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032] - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032] - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032] - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183} - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219] - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219] - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219] - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219] - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219] - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219] - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219] - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347} - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243} - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890] - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890] - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890] - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890] - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890] - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890] - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890] - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613} - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961] - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858} - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392} - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781} - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - [rt] build kernel-rt-4.18.0-553.16.1.rt7.357.el8_10 [RHEL-44553] - x86/bhi: Fix incorrect CLEAR_BRANCH_HISTORY position in entry_INT80_compat (Waiman Long) [RHEL-50648] - [rt] build kernel-rt-4.18.0-553.15.1.rt7.356.el8_10 [RHEL-44553] - Revert "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-44613] - ionic: fix use after netif_napi_del() (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - ionic: clean interrupt before enabling queue to avoid credit race (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change (CKI Backport Bot) [RHEL-49321] {CVE-2021-47624} - xhci: Handle TD clearing for multiple streams case (CKI Backport Bot) [RHEL-47882] {CVE-2024-40927} - net: openvswitch: Fix Use-After-Free in ovs_ct_exit (cki-backport-bot) [RHEL-36362] {CVE-2024-27395} - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: fix vlan use-after-free (cki-backport-bot) [RHEL-43721] {CVE-2024-36979} - irqchip/gic-v3-its: Prevent double free on error (Charles Mirabile) [RHEL-37022] {CVE-2024-35847} - irqchip/gic-v3-its: Fix potential VPE leak on error (Charles Mirabile) [RHEL-37744] {CVE-2021-47373} - i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() (Charles Mirabile) [RHEL-34735] {CVE-2022-48632} - iommu/dma: fix zeroing of bounce buffer padding used by untrusted devices (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: remove alloc_size argument to swiotlb_tbl_map_single() (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: fix swiotlb_bounce() to do partial sync's correctly (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Reinstate page-alignment for mappings >= PAGE_SIZE (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix alignment checks when both allocation and DMA masks are present (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix double-allocation of slots due to broken alignment handling (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (cki-backport-bot) [RHEL-44441] {CVE-2024-31076} - [rt] build kernel-rt-4.18.0-553.14.1.rt7.355.el8_10 [RHEL-44553] - s390/qeth: Fix kernel panic after setting hsuid (Mete Durlu) [RHEL-49754] - perf/core: Protect event sibling list locking against interrupt inversion (Daniel Vacek) [RHEL-31798] - vt: fix unicode buffer corruption when deleting characters (Steve Best) [RHEL-36936] {CVE-2024-35823} - cifs: translate network errors on send to -ECONNABORTED (Paulo Alcantara) [RHEL-36754] - xfs: don't block in busy flushing when freeing extents (Brian Foster) [RHEL-7984] - xfs: allow extent free intents to be retried (Brian Foster) [RHEL-7984] - xfs: pass alloc flags through to xfs_extent_busy_flush() (Brian Foster) [RHEL-7984] - xfs: use deferred frees for btree block freeing (Brian Foster) [RHEL-7984] - xfs: fix bounds check in xfs_defer_agfl_block() (Brian Foster) [RHEL-7984] - xfs: validate block number being freed before adding to xefi (Brian Foster) [RHEL-7984] - xfs: rename xfs_bmap_add_free to xfs_free_extent_later (Brian Foster) [RHEL-7984] - usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (Desnes Nunes) [RHEL-36803] {CVE-2024-35790} - stm class: Fix a double free in stm_register_device() (Steve Best) [RHEL-44514] {CVE-2024-38627} - s390/qeth: Fix potential loss of L3-IP@ in case of network issues (Mete Durlu) [RHEL-49755] - tls: fix missing memory barrier in tls_init (cki-backport-bot) [RHEL-44471] {CVE-2024-36489} - xfs: fix log recovery buffer allocation for the legacy h_size fixup (Bill O'Donnell) [RHEL-46473] {CVE-2024-39472} - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: use __for_each_thread() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - exit: Use the correct exit_code in /proc/<pid>/stat (Brian Foster) [RHEL-31562] {CVE-2024-26686} - scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool (Ewan D. Milne) [RHEL-38283] {CVE-2023-52811} - scsi: qla2xxx: Fix double free of fcport (Ewan D. Milne) [RHEL-39549] {CVE-2024-26929} - scsi: qla2xxx: Fix double free of the ha->vp_map pointer (Ewan D. Milne) [RHEL-39549] {CVE-2024-26930} - scsi: qla2xxx: Fix command flush on cable pull (Ewan D. Milne) [RHEL-39549] {CVE-2024-26931} - [rt] build kernel-rt-4.18.0-553.13.1.rt7.354.el8_10 [RHEL-44553] - redhat: remove handling of deleted rhdocs/ directory from genspec.sh (Denys Vlasenko) - x86/bugs: Fix BHI retpoline check (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI handling of RRSBA (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr' (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI documentation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix return type of spectre_bhi_state() (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Make CONFIG_SPECTRE_BHI_ON the default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Mitigate KVM by default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add BHI mitigation knob (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Enumerate Branch History Injection (BHI) bug (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Define SPEC_CTRL_BHI_DIS_S (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add support for clearing branch history at syscall entry (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file (Waiman Long) [RHEL-28202] - perf/x86/amd/lbr: Use freeze based on availability (Waiman Long) [RHEL-28202] - Documentation/kernel-parameters: Add spec_rstack_overflow to mitigations=off (Waiman Long) [RHEL-28202] - KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace (Waiman Long) [RHEL-28202] - x86/bugs: Reset speculation control settings on init (Waiman Long) [RHEL-28202] - KVM: x86: Update KVM-only leaf handling to allow for 100% KVM-only leafs (Waiman Long) [RHEL-28202] - KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest (Waiman Long) [RHEL-28202] - mptcp: ensure snd_nxt is properly initialized on connect (Davide Caratti) [RHEL-39865] {CVE-2024-36889} - powerpc/pseries: Enforce hcall result buffer validity and size (Mamatha Inamdar) [RHEL-48291] {CVE-2024-40974} - wifi: mac80211: fix potential key use-after-free (Jose Ignacio Tornos Martinez) [RHEL-28007] {CVE-2023-52530} - cppc_cpufreq: Fix possible null pointer dereference (Mark Langsdorf) [RHEL-44137] {CVE-2024-38573} - net/sched: act_mirred: use the backlog for mirred ingress (Davide Caratti) [RHEL-31718] {CVE-2024-26740} - vfio/pci: Lock external INTx masking ops (Alex Williamson) [RHEL-31922] {CVE-2024-26810} - net: sched: sch_multiq: fix possible OOB write in multiq_tune() (Davide Caratti) [RHEL-43464] {CVE-2024-36978} - tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized (Guillaume Nault) [RHEL-37850] {CVE-2021-47304} - pstore/ram: Fix crash when setting number of cpus to an odd number (Lenny Szubowicz) [RHEL-29471] {CVE-2023-52619} - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node (Jocelyn Falempe) [RHEL-37101] {CVE-2023-52662} - drm/vmwgfx: Fix the lifetime of the bo cursor memory (Jocelyn Falempe) [RHEL-36962] {CVE-2024-35810} - drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed (Jocelyn Falempe) [RHEL-34987] {CVE-2024-26940} - drm/vmwgfx: Unmap the surface before resetting it on a plane state (Jocelyn Falempe) [RHEL-35217] {CVE-2023-52648} - drm/vmwgfx: Fix invalid reads in fence signaled events (Jocelyn Falempe) [RHEL-40010] {CVE-2024-36960} - block: Fix wrong offset in bio_truncate() (Ming Lei) [RHEL-43782] {CVE-2022-48747} - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CKI Backport Bot) [RHEL-46913] {CVE-2024-39487} - net: fix __dst_negative_advice() race (Xin Long) [RHEL-41183] {CVE-2024-36971} - igc: avoid returning frame twice in XDP_REDIRECT (Corinna Vinschen) [RHEL-33264] {CVE-2024-26853} - mac802154: fix llsec key resources release in mac802154_llsec_key_del (Steve Best) [RHEL-34967] {CVE-2024-26961} - cpufreq: exit() callback is optional (Mark Langsdorf) [RHEL-43840] {CVE-2024-38615} - cifs: prevent infinite recursion in CIFSGetDFSRefer() (Paulo Alcantara) [RHEL-34672] - cifs: lock chan_lock outside match_session (Paulo Alcantara) [RHEL-34672] - smb3: workaround negprot bug in some Samba servers (Paulo Alcantara) [RHEL-34672] - smb3: use netname when available on secondary channels (Paulo Alcantara) [RHEL-34672] - smb3: fix empty netname context on secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: populate empty hostnames for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: always iterate smb sessions using primary channel (Paulo Alcantara) [RHEL-34672] - cifs: Fix connections leak when tlink setup failed (Paulo Alcantara) [RHEL-34672] - cifs: Fix memory leak when build ntlmssp negotiate blob failed (Paulo Alcantara) [RHEL-34672] - cifs: always initialize struct msghdr smb_msg completely (Paulo Alcantara) [RHEL-34672] - cifs: don't send down the destination address to sendmsg for a SOCK_STREAM (Paulo Alcantara) [RHEL-34672] - cifs: revalidate mapping when doing direct writes (Paulo Alcantara) [RHEL-34672] - cifs: skip extra NULL byte in filenames (Paulo Alcantara) [RHEL-34672] - cifs: list_for_each() -> list_for_each_entry() (Paulo Alcantara) [RHEL-34672] - smb2: small refactor in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - cifs: Fix crash on unload of cifs_arc4.ko (Paulo Alcantara) [RHEL-34672] - cifs: remove check of list iterator against head past the loop body (Paulo Alcantara) [RHEL-34672] - cifs: fix reconnect on smb3 mount types (Paulo Alcantara) [RHEL-34672] - cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (Paulo Alcantara) [RHEL-34672] - cifs: skip trailing separators of prefix paths (Paulo Alcantara) [RHEL-34672] - cifs: fix ntlmssp on old servers (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL ptr dereference in refresh_mounts() (Paulo Alcantara) [RHEL-34672] - cifs: do not skip link targets when an I/O fails (Paulo Alcantara) [RHEL-34672] - cifs: fix confusing unneeded warning message on smb2.1 and earlier (Paulo Alcantara) [RHEL-34672] - smb3: fix snapshot mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix workstation_name for multiuser mounts (Paulo Alcantara) [RHEL-34672] - cifs: alloc_path_with_tree_prefix: do not append sep. if the path is empty (Paulo Alcantara) [RHEL-34672] - cifs: free ntlmsspblob allocated in negotiate (Paulo Alcantara) [RHEL-34672] - cifs: avoid use of dstaddr as key for fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: add server conn_id to fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: fix missed refcounting of ipc tcon (Paulo Alcantara) [RHEL-34672] - smb2: clarify rc initialization in smb2_reconnect (Paulo Alcantara) [RHEL-34672] - cifs: populate server_hostname for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should be set on new server (Paulo Alcantara) [RHEL-34672] - cifs: introduce cifs_ses_mark_for_reconnect() helper (Paulo Alcantara) [RHEL-34672] - cifs: protect srv_count with cifs_tcp_ses_lock (Paulo Alcantara) [RHEL-34672] - cifs: move debug print out of spinlock (Paulo Alcantara) [RHEL-34672] - cifs: do not duplicate fscache cookie for secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: connect individual channel servers to primary channel server (Paulo Alcantara) [RHEL-34672] - cifs: protect session channel fields with chan_lock (Paulo Alcantara) [RHEL-34672] - cifs: do not negotiate session if session already exists (Paulo Alcantara) [RHEL-34672] - smb3: do not setup the fscache_super_cookie until fsinfo initialized (Paulo Alcantara) [RHEL-34672] - cifs: fix potential use-after-free bugs (Paulo Alcantara) [RHEL-34672] - cifs: release lock earlier in dequeue_mid error case (Paulo Alcantara) [RHEL-34672] - smb3: remove trivial dfs compile warning (Paulo Alcantara) [RHEL-34672] - cifs: support nested dfs links over reconnect (Paulo Alcantara) [RHEL-34672] - cifs: for compound requests, use open handle if possible (Paulo Alcantara) [RHEL-34672] - cifs: split out dfs code from cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant (Paulo Alcantara) [RHEL-34672] - cifs: introduce new helper for cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: fix print of hdr_flags in dfscache_proc_show() (Paulo Alcantara) [RHEL-34672] - cifs: send workstation name during ntlmssp session setup (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should not share socket with future sessions (Paulo Alcantara) [RHEL-34672] - smb3: add dynamic trace points for socket connection (Paulo Alcantara) [RHEL-34672] - cifs: Move SMB2_Create definitions to the shared area (Paulo Alcantara) [RHEL-34672] - cifs: Move more definitions into the shared area (Paulo Alcantara) [RHEL-34672] - cifs: move NEGOTIATE_PROTOCOL definitions out into the common area (Paulo Alcantara) [RHEL-34672] - cifs: Create a new shared file holding smb2 pdu definitions (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect check for null pointer in header_assemble (Paulo Alcantara) [RHEL-34672] - smb3: correct server pointer dereferencing check to be more consistent (Paulo Alcantara) [RHEL-34672] - cifs: Deal with some warnings from W=1 (Paulo Alcantara) [RHEL-34672] - cifs: fix a sign extension bug (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect kernel doc comments (Paulo Alcantara) [RHEL-34672] - cifs: remove pathname for file from SPDX header (Paulo Alcantara) [RHEL-34672] - cifs: move SMB FSCTL definitions to common code (Paulo Alcantara) [RHEL-34672] - cifs: rename cifs_common to smbfs_common (Paulo Alcantara) [RHEL-34672] - cifs: update FSCTL definitions (Paulo Alcantara) [RHEL-34672] - cifs: cifs_md4 convert to SPDX identifier (Paulo Alcantara) [RHEL-34672] - cifs: create a MD4 module and switch cifs.ko to use it (Paulo Alcantara) [RHEL-34672] - cifs: fork arc4 and create a separate module for it for cifs and other users (Paulo Alcantara) [RHEL-34672] - smb3: fix posix extensions mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix wrong release in sess_alloc_buffer() failed path (Paulo Alcantara) [RHEL-34672] - CIFS: Fix a potencially linear read overflow (Paulo Alcantara) [RHEL-34672] - cifs: use the correct max-length for dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: create sd context must be a multiple of 8 (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp sessions of dfs connections (Paulo Alcantara) [RHEL-34672] - cifs: added WARN_ON for all the count decrements (Paulo Alcantara) [RHEL-34672] - cifs: fix missing null session check in mount (Paulo Alcantara) [RHEL-34672] - cifs: handle reconnect of tcon when there is no cached dfs referral (Paulo Alcantara) [RHEL-34672] - cifs: fix the out of range assignment to bit fields in parse_server_interfaces (Paulo Alcantara) [RHEL-34672] - smb3: fix typo in header file (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: Add support for negotiating signing algorithm (Paulo Alcantara) [RHEL-34672] - cifs: prevent NULL deref in cifs_compose_mount_options() (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL dereference in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - smbdirect: missing rc checks while waiting for rdma events (Paulo Alcantara) [RHEL-34672] - cifs: Avoid field over-reading memcpy() (Paulo Alcantara) [RHEL-34672] - smb311: remove dead code for non compounded posix query info (Paulo Alcantara) [RHEL-34672] - cifs: fix SMB1 error path in cifs_get_file_info_unix (Paulo Alcantara) [RHEL-34672] - smb3: fix uninitialized value for port in witness protocol move (Paulo Alcantara) [RHEL-34672] - cifs: fix unneeded null check (Paulo Alcantara) [RHEL-34672] - cifs: use SPDX-Licence-Identifier (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in cifs_debug.c (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in smb2misc.c (Paulo Alcantara) [RHEL-34672] - cifs: missed ref-counting smb session in find (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp servers with dfs mounts (Paulo Alcantara) [RHEL-34672] - cifs: set a minimum of 2 minutes for refreshing dfs cache (Paulo Alcantara) [RHEL-34672] - cifs: Remove unused inline function is_sysvol_or_netlogon() (Paulo Alcantara) [RHEL-34672] - cifs: remove duplicated prototype (Paulo Alcantara) [RHEL-34672] - cifs: fix ipv6 formating in cifs_ses_add_channel (Paulo Alcantara) [RHEL-34672] - cifs: fix string declarations and assignments in tracepoints (Paulo Alcantara) [RHEL-34672] - cifs: fix memory leak in smb2_copychunk_range (Paulo Alcantara) [RHEL-34672] - SMB3: incorrect file id in requests compounded with open (Paulo Alcantara) [RHEL-34672] - smb3: if max_channels set to more than one channel request multichannel (Paulo Alcantara) [RHEL-34672] - smb3: do not attempt multichannel to server which does not support it (Paulo Alcantara) [RHEL-34672] - smb3: when mounting with multichannel include it in requested capabilities (Paulo Alcantara) [RHEL-34672] - cifs: simplify SWN code with dummy funcs instead of ifdefs (Paulo Alcantara) [RHEL-34672] - cifs: log mount errors using cifs_errorf() (Paulo Alcantara) [RHEL-34672] - cifs: switch build_path_from_dentry() to using dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: fix out-of-bound memory access when calling smb3_notify() at mount point (Paulo Alcantara) [RHEL-34672] - cifs: allocate buffer in the caller of build_path_from_dentry() (Paulo Alcantara) [RHEL-34672] - cifs: make build_path_from_dentry() return const char * (Paulo Alcantara) [RHEL-34672] - cifs: remove old dead code (Paulo Alcantara) [RHEL-34672] - fs: cifs: Remove repeated struct declaration (Paulo Alcantara) [RHEL-34672] - cifs: have cifs_fattr_to_inode() refuse to change type on live inode (Paulo Alcantara) [RHEL-34672] - cifs: have ->mkdir() handle race with another client sanely (Paulo Alcantara) [RHEL-34672] - do_cifs_create(): don't set ->i_mode of something we had not created (Paulo Alcantara) [RHEL-34672] - cifs: Silently ignore unknown oplock break handle (Paulo Alcantara) [RHEL-34672] - cifs: change noisy error message to FYI (Paulo Alcantara) [RHEL-34672] - cifs: print MIDs in decimal notation (Paulo Alcantara) [RHEL-34672] - cifs: minor simplification to smb2_is_network_name_deleted (Paulo Alcantara) [RHEL-34672] - TCON Reconnect during STATUS_NETWORK_NAME_DELETED (Paulo Alcantara) [RHEL-34672] - cifs: clarify hostname vs ip address in /proc/fs/cifs/DebugData (Paulo Alcantara) [RHEL-34672] - cifs: change confusing field serverName (to ip_addr) (Paulo Alcantara) [RHEL-34672] - cifs: Reformat DebugData and index connections by conn_id. (Paulo Alcantara) [RHEL-34672] - cifs: Identify a connection by a conn_id. (Paulo Alcantara) [RHEL-34672] - smb3: negotiate current dialect (SMB3.1.1) when version 3 or greater requested (Paulo Alcantara) [RHEL-34672] - smb3: Fix out-of-bounds bug in SMB2_negotiate() (Paulo Alcantara) [RHEL-34672] - fs/cifs: Simplify bool comparison. (Paulo Alcantara) [RHEL-34672] - fs/cifs: Assign boolean values to a bool variable (Paulo Alcantara) [RHEL-34672] - cifs: Avoid error pointer dereference (Paulo Alcantara) [RHEL-34672] - cifs: Re-indent cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Unlock on errors in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Delete a stray unlock in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Tracepoints and logs for tracing credit changes. (Paulo Alcantara) [RHEL-34672] - cifs: Fix some error pointers handling detected by static checker (Paulo Alcantara) [RHEL-34672] - smb3: remind users that witness protocol is experimental (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: do not log warning message if server doesn't populate salt (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: update comments clarifying SPNEGO info in negprot response (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot rsp (Paulo Alcantara) [RHEL-34672] - SMB3: avoid confusing warning message on mount to Azure (Paulo Alcantara) [RHEL-34672] - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (Nigel Croxon) [RHEL-46662] {CVE-2024-39476} - net: fix information leakage in /proc/net/ptype (Hangbin Liu) [RHEL-44000] {CVE-2022-48757} - usb: typec: ucsi: Limit read size on v1.2 (Desnes Nunes) [RHEL-37286] {CVE-2024-35924} - minmax: relax check to allow comparison between unsigned arguments and signed constants (Desnes Nunes) [RHEL-37286] - minmax: allow comparisons of 'int' against 'unsigned char/short' (Desnes Nunes) [RHEL-37286] - minmax: allow min()/max()/clamp() if the arguments have the same signedness. (Desnes Nunes) [RHEL-37286] - minmax: add umin(a, b) and umax(a, b) (Desnes Nunes) [RHEL-37286] - minmax: fix header inclusions (Desnes Nunes) [RHEL-37286] - minmax: clamp more efficiently by avoiding extra comparison (Desnes Nunes) [RHEL-37286] - minmax: sanity check constant bounds when clamping (Desnes Nunes) [RHEL-37286] - tracing: Define the is_signed_type() macro once (Desnes Nunes) [RHEL-37286] - linux/bits.h: fix compilation error with GENMASK (Desnes Nunes) [RHEL-37286] - x86/apic: Mask IOAPIC entries when disabling the local APIC (Lenny Szubowicz) [RHEL-18077] - userfaultfd: fix a race between writeprotect and exit_mmap() (Rafael Aquini) [RHEL-38410] {CVE-2021-47461} - mm: khugepaged: skip huge page collapse for special files (Waiman Long) [RHEL-38446] {CVE-2021-47491} - cachefiles: fix memory leak in cachefiles_add_cache() (Andrey Albershteyn) [RHEL-33109] {CVE-2024-26840} - drm/amd/display: Implement bounds check for stream encoder creation in DCN301 (Michel Dänzer) [RHEL-31429] {CVE-2024-26660} - net/mlx5: Discard command completions in internal error (Kamal Heib) [RHEL-44231] {CVE-2024-38555} - drm: Don't unref the same fb many times by mistake due to deadlock handling (CKI Backport Bot) [RHEL-29011] {CVE-2023-52486} - md: fix resync softlockup when bitmap size is less than array size (Nigel Croxon) [RHEL-43942] {CVE-2024-38598} - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation (Davide Caratti) [RHEL-39712] {CVE-2024-36017} - netfilter: nf_tables: discard table flag update with pending basechain deletion (Phil Sutter) [RHEL-37205] {CVE-2024-35897} - netfilter: nf_tables: reject table flag and netdev basechain updates (Phil Sutter) [RHEL-37205] - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (Ewan D. Milne) [RHEL-40172] {CVE-2024-36924} - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (Ewan D. Milne) [RHEL-40172] {CVE-2024-36952} - netfilter: nf_tables: fix memleak in map from abort path (Phil Sutter) [RHEL-35052] {CVE-2024-27011} - netfilter: nf_tables: reject new basechain after table flag update (Phil Sutter) [RHEL-37193] {CVE-2024-35900} - netfilter: nf_tables: flush pending destroy work before exit_net release (Phil Sutter) [RHEL-37197] {CVE-2024-35899} - netfilter: complete validation of user input (Phil Sutter) [RHEL-37210] - netfilter: validate user input for expected length (Phil Sutter) [RHEL-37210] {CVE-2024-35896} - netfilter: tproxy: bail out if IP has been disabled on the device (Phil Sutter) [RHEL-44363] {CVE-2024-36270} - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (Phil Sutter) [RHEL-44532] {CVE-2024-36286} - netfilter: nf_tables: do not compare internal table flags on updates (Phil Sutter) [RHEL-35114] {CVE-2024-27065} - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (Phil Sutter) [RHEL-35028] {CVE-2024-27019} - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (Phil Sutter) [RHEL-35024] {CVE-2024-27020} - netfilter: nf_tables: __nft_expr_type_get() selects specific family type (Phil Sutter) [RHEL-35024] - netfilter: conntrack: serialize hash resizes and cleanups (Phil Sutter) [RHEL-37703] {CVE-2021-47408} - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (Phil Sutter) [RHEL-34217] {CVE-2024-26925} - netfilter: nf_tables: release batch on table validation from abort path (Phil Sutter) [RHEL-34217] - ipvlan: add ipvlan_route_v6_outbound() helper (Davide Caratti) [RHEL-38319] {CVE-2023-52796} - [rt] build kernel-rt-4.18.0-553.12.1.rt7.353.el8_10 [RHEL-44553] - net: bridge: xmit: make sure we have at least eth header len bytes (cki-backport-bot) [RHEL-44291] {CVE-2024-38538} - drivers/amd/pm: fix a use-after-free in kv_parse_power_table (Michel Dänzer) [RHEL-26893] {CVE-2023-52469} - SUNRPC: Fix a suspicious RCU usage warning (Scott Mayhew) [RHEL-30503] {CVE-2023-52623} - ice: Fix some null pointer dereference issues in ice_ptp.c (Petr Oros) [RHEL-26901] {CVE-2023-52471} - xfs: fix internal error from AGFL exhaustion (Pavel Reichl) [RHEL-45581] - sched/psi: Fix use-after-free in ep_remove_wait_queue() (Phil Auld) [RHEL-38117] {CVE-2023-52707} - wait: add wake_up_pollfree() (Phil Auld) [RHEL-38117] - net/ipv6: avoid possible UAF in ip6_route_mpath_notify() (Hangbin Liu) [RHEL-33269] {CVE-2024-26852} - net: bridge: switchdev: Skip MDB replays of deferred events on offload (Ivan Vecera) [RHEL-33117] {CVE-2024-26837} - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (Pavel Reichl) [RHEL-31700] {CVE-2024-26772} - ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() (Pavel Reichl) [RHEL-31688] {CVE-2024-26773} - ext4: fix double-free of blocks due to wrong extents moved_len (Pavel Reichl) [RHEL-31612] {CVE-2024-26704} - vxlan: Pull inner IP header in vxlan_xmit_one(). (Guillaume Nault) [RHEL-31389] - geneve: Fix incorrect inner network header offset when innerprotoinherit is set (Guillaume Nault) [RHEL-31389] - vxlan: Pull inner IP header in vxlan_rcv(). (Guillaume Nault) [RHEL-31389] - geneve: fix header validation in geneve[6]_xmit_skb (Guillaume Nault) [RHEL-31389] - geneve: make sure to pull inner header in geneve_rx() (Guillaume Nault) [RHEL-31389] - net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb (Guillaume Nault) [RHEL-31389] - net: geneve: check skb is large enough for IPv4/IPv6 header (Guillaume Nault) [RHEL-31389] - net/smc: fix neighbour and rtable leak in smc_ib_find_route() (Tobias Huschle) [RHEL-39744] {CVE-2024-36945} - igb: Fix string truncation warnings in igb_set_fw_version (Corinna Vinschen) [RHEL-38452] {CVE-2024-36010} - bonding: stop the device in bond_setup_by_slave() (Hangbin Liu) [RHEL-38327] {CVE-2023-52784} - i40e: fix vf may be used uninitialized in this function warning (Kamal Heib) [RHEL-39702] {CVE-2024-36020} - powerpc/64: Fix the definition of the fixmap area (Mamatha Inamdar) [RHEL-27191] {CVE-2021-47018} - powerpc/mm/hash64: Add a variable to track the end of IO mapping (Mamatha Inamdar) [RHEL-27191] {CVE-2021-47018} - nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). (Xin Long) [RHEL-39770] {CVE-2024-36933} - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (Xin Long) [RHEL-39770] - net: core: reject skb_copy(_expand) for fraglist GSO skbs (Xin Long) [RHEL-39779] {CVE-2024-36929} - tcp: properly terminate timers for kernel sockets (Guillaume Nault) [RHEL-37171] {CVE-2024-35910} - net: relax socket state check at accept time. (Florian Westphal) [RHEL-39831] - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (Florian Westphal) [RHEL-39831] {CVE-2024-36905} - tcp: remove redundant check on tskb (Florian Westphal) [RHEL-39831] - drm/ast: Fix soft lockup (cki-backport-bot) [RHEL-37438] {CVE-2024-35952} - null_blk: Fix return value of nullb_device_power_store() (Ming Lei) [RHEL-39341] - null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues' (Ming Lei) [RHEL-39341] - null_blk: fix return value from null_add_dev() (Ming Lei) [RHEL-39341] - [rt] build kernel-rt-4.18.0-553.11.1.rt7.352.el8_10 [RHEL-44553] - x86/bugs: Reverse instruction order of CLEAR_CPU_BUFFERS (Waiman Long) [RHEL-42121] - Revert "x86/bugs: Use fixed addressing for VERW operand" (Waiman Long) [RHEL-42121] - KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests (Waiman Long) [RHEL-42121] - x86/rfds: Mitigate Register File Data Sampling (RFDS) (Waiman Long) [RHEL-42121] - Documentation/hw-vuln: Add documentation for RFDS (Waiman Long) [RHEL-42121] - x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set (Waiman Long) [RHEL-42121] - x86/bugs: Use fixed addressing for VERW operand (Waiman Long) [RHEL-42121] - KVM/VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH (Waiman Long) [RHEL-42121] - x86/bugs: Use ALTERNATIVE() instead of mds_user_clear static key (Waiman Long) [RHEL-42121] - x86/entry_32: Add VERW just before userspace transition (Waiman Long) [RHEL-42121] - x86/entry_64: Add VERW just before userspace transition (Waiman Long) [RHEL-42121] - x86/bugs: Add asm helpers for executing VERW (Waiman Long) [RHEL-42121] - x86/cpu: Fix Gracemont uarch (Waiman Long) [RHEL-42121] - Documentation/hw-vuln: Unify filename specification in index (Waiman Long) [RHEL-42121] - KVM: VMX: Access @flags as a 32-bit value in __vmx_vcpu_run() (Waiman Long) [RHEL-42121] - x86/asm: Add _ASM_RIP() macro for x86-64 (%rip) suffix (Waiman Long) [RHEL-42121] - x86/asm: Have the __ASM_FORM macros handle commas in arguments (Waiman Long) [RHEL-42121] - x86/asm: Allow to pass macros to __ASM_FORM() (Waiman Long) [RHEL-42121] - wifi: iwlwifi: mvm: guard against invalid STA ID on removal (Jose Ignacio Tornos Martinez) [RHEL-39801] {CVE-2024-36921} - ipv6: Fix potential uninit-value access in __ip6_make_skb() (Antoine Tenart) [RHEL-39784] - ipv4: Fix uninit-value access in __ip_make_skb() (Antoine Tenart) [RHEL-39784] {CVE-2024-36927} - perf mmap: Lazily initialize zstd streams to save memory when not using it (Michael Petlan) [RHEL-34876] - perf tools: Fix spelling mistake "commpressor" -> "compressor" (Michael Petlan) [RHEL-34876] - perf record: Introduce data transferred and compressed stats (Michael Petlan) [RHEL-34876] - perf record: Introduce compressor at mmap buffer object (Michael Petlan) [RHEL-34876] - perf record: Introduce bytes written stats (Michael Petlan) [RHEL-34876] - perf record: Introduce data file at mmap buffer object (Michael Petlan) [RHEL-34876] - perf record: Start threads in the beginning of trace streaming (Alexey Bayduraev) [RHEL-34876] - perf record: Stop threads in the end of trace streaming (Michael Petlan) [RHEL-34876] - perf record: Introduce thread local variable (Michael Petlan) [RHEL-34876] - perf record: Introduce function to propagate control commands (Michael Petlan) [RHEL-34876] - perf record: Introduce thread specific data array (Michael Petlan) [RHEL-34876] - tools lib: Introduce fdarray duplicate function (Michael Petlan) [RHEL-34876] - perf record: Introduce thread affinity and mmap masks (Michael Petlan) [RHEL-34876] - gfs2: Be more careful with the quota sync generation (Andreas Gruenbacher) [RHEL-40901] - gfs2: Get rid of some unnecessary quota locking (Andreas Gruenbacher) [RHEL-40901] - gfs2: Add some missing quota locking (Andreas Gruenbacher) [RHEL-40901] - gfs2: Fold qd_fish into gfs2_quota_sync (Andreas Gruenbacher) [RHEL-40901] - gfs2: quota need_sync cleanup (Andreas Gruenbacher) [RHEL-40901] - gfs2: Fix and clean up function do_qc (Andreas Gruenbacher) [RHEL-40901] - gfs2: Revert "Add quota_change type" (Andreas Gruenbacher) [RHEL-40901] - gfs2: Revert "ignore negated quota changes" (Andreas Gruenbacher) [RHEL-40901] - gfs2: qd_check_sync cleanups (Andreas Gruenbacher) [RHEL-40901] - gfs2: Check quota consistency on mount (Andreas Gruenbacher) [RHEL-40901] - gfs2: Minor gfs2_quota_init error path cleanup (Andreas Gruenbacher) [RHEL-40901] - gfs2: fix kernel BUG in gfs2_quota_cleanup (Edward Adam Davis) [RHEL-40901] - gfs2: Clean up quota.c:print_message (Andreas Gruenbacher) [RHEL-40901] - gfs2: Clean up gfs2_alloc_parms initializers (Andreas Gruenbacher) [RHEL-40901] - gfs2: Two quota=account mode fixes (Andreas Gruenbacher) [RHEL-40901] - gfs2: Remove useless assignment (Bob Peterson) [RHEL-40901] - gfs2: simplify slot_get (Bob Peterson) [RHEL-40901] - gfs2: Simplify qd2offset (Bob Peterson) [RHEL-40901] - gfs2: Remove quota allocation info from quota file (Bob Peterson) [RHEL-40901] - gfs2: use constant for array size (Bob Peterson) [RHEL-40901] - gfs2: Set qd_sync_gen in do_sync (Bob Peterson) [RHEL-40901] - gfs2: Remove useless err set (Bob Peterson) [RHEL-40901] - gfs2: Small gfs2_quota_lock cleanup (Bob Peterson) [RHEL-40901] - gfs2: move qdsb_put and reduce redundancy (Bob Peterson) [RHEL-40901] - gfs2: Don't try to sync non-changes (Bob Peterson) [RHEL-40901] - gfs2: Simplify function need_sync (Bob Peterson) [RHEL-40901] - gfs2: remove unneeded pg_oflow variable (Bob Peterson) [RHEL-40901] - gfs2: remove unneeded variable done (Bob Peterson) [RHEL-40901] - gfs2: pass sdp to gfs2_write_buf_to_page (Bob Peterson) [RHEL-40901] - gfs2: pass sdp in to gfs2_write_disk_quota (Bob Peterson) [RHEL-40901] - gfs2: Pass sdp to gfs2_adjust_quota (Bob Peterson) [RHEL-40901] - gfs2: remove dead code for quota writes (Bob Peterson) [RHEL-40901] - gfs2: Use qd_sbd more consequently (Bob Peterson) [RHEL-40901] - gfs2: replace 'found' with dedicated list iterator variable (Jakob Koschel) [RHEL-40901] - gfs2: Some whitespace cleanups (Andreas Gruenbacher) [RHEL-40901] - gfs2: Fix gfs2_qa_get imbalance in gfs2_quota_hold (Bob Peterson) [RHEL-40901] - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg (Guillaume Nault) [RHEL-43961] {CVE-2024-38596} - af_unix: Fix data-races around sk->sk_shutdown. (Guillaume Nault) [RHEL-43961] {CVE-2024-38596} - af_unix: Fix data races around sk->sk_shutdown. (Guillaume Nault) [RHEL-43961] {CVE-2024-38596} - perf/core: Fix event sibling list locking (Daniel Vacek) [RHEL-31798] - media: bttv: fix use after free error due to btv->timeout timer (Kate Hsuan) [RHEL-38256] {CVE-2023-52847} - arp: Prevent overflow in arp_req_get(). (Antoine Tenart) [RHEL-31706] {CVE-2024-26733} - Bluetooth: btusb: Add a new PID/VID 0489/e0c8 for MT7921 (David Marlin) [RHEL-10263] - mm: swap: fix race between free_swap_and_cache() and swapoff() (Waiman Long) [RHEL-34971] {CVE-2024-26960} - swap: comments get_swap_device() with usage rule (Waiman Long) [RHEL-34971] {CVE-2024-26960} - mm/swapfile.c: __swap_entry_free() always free 1 entry (Waiman Long) [RHEL-34971] {CVE-2024-26960} - mm/swapfile.c: call free_swap_slot() in __swap_entry_free() (Waiman Long) [RHEL-34971] {CVE-2024-26960} - mm/swapfile.c: use __try_to_reclaim_swap() in free_swap_and_cache() (Waiman Long) [RHEL-34971] {CVE-2024-26960} - net: amd-xgbe: Fix skb data length underflow (Ken Cox) [RHEL-43788] {CVE-2022-48743} - ovl: fix warning in ovl_create_real() (cki-backport-bot) [RHEL-43652] {CVE-2021-47579} - net/sched: initialize noop_qdisc owner (Davide Caratti) [RHEL-35056] - net/sched: Fix mirred deadlock on device recursion (Davide Caratti) [RHEL-35056] {CVE-2024-27010} - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (Pavel Reichl) [RHEL-45029] {CVE-2024-39276} - ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() (Ken Cox) [RHEL-38713] {CVE-2021-47548} - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound (Hangbin Liu) [RHEL-44396] {CVE-2024-33621} - mlxsw: spectrum_acl_tcam: Fix stack corruption (Ivan Vecera) [RHEL-26462] {CVE-2024-26586} - inet: inet_defrag: prevent sk release while still in use (Antoine Tenart) [RHEL-33398] {CVE-2024-26921} - skb_expand_head() adjust skb->truesize incorrectly (Antoine Tenart) [RHEL-33398] - nvmet: fix ns enable/disable possible hang (Ming Lei) [RHEL-43547] - [rt] build kernel-rt-4.18.0-553.10.1.rt7.351.el8_10 [RHEL-44553] - SUNRPC: Fix RPC client cleaned up the freed pipefs dentries (Scott Mayhew) [RHEL-38264] {CVE-2023-52803} - scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() (Ewan D. Milne) [RHEL-39717] {CVE-2024-36025} - tcp: add sanity checks to rx zerocopy (Guillaume Nault) [RHEL-29494] {CVE-2024-26640} - SUNRPC: fix some memleaks in gssx_dec_option_array (Scott Mayhew) [RHEL-35209] {CVE-2024-27388} - wifi: nl80211: don't free NULL coalescing rule (Jose Ignacio Tornos Martinez) [RHEL-39752] {CVE-2024-36941} - nfs: fix UAF in direct writes (Scott Mayhew) [RHEL-34975] {CVE-2024-26958} - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 (Scott Mayhew) [RHEL-33228] {CVE-2024-26870} - drm/amd/pm: Fix error of MACO flag setting code (Michel Dänzer) [RHEL-15928] - scsi: aacraid: fix io hangs and improve performance (John Meneghini) [RHEL-23913] - block: prevent division by zero in blk_rq_stat_sum() (Ming Lei) [RHEL-37279] {CVE-2024-35925} - block: fix overflow in blk_ioctl_discard() (Ming Lei) [RHEL-39811] {CVE-2024-36917} - virtio-blk: fix implicit overflow on virtio_max_dma_size (Ming Lei) [RHEL-38131] {CVE-2023-52762} - nbd: null check for nla_nest_start (Ming Lei) [RHEL-35176] {CVE-2024-27025} - isdn: mISDN: netjet: Fix crash in nj_probe: (Ken Cox) [RHEL-38444] {CVE-2021-47284} - isdn: mISDN: Fix sleeping function called from invalid context (Ken Cox) [RHEL-38400] {CVE-2021-47468} - net/smc: avoid data corruption caused by decline (Tobias Huschle) [RHEL-38234] {CVE-2023-52775} - ubi: Check for too small LEB size in VTBL code (David Arcari) [RHEL-25092] {CVE-2024-25739} - i2c: core: Fix atomic xfer check for non-preempt config (Steve Best) [RHEL-38313] {CVE-2023-52791} - i2c: core: Run atomic i2c xfer when !preemptible (Steve Best) [RHEL-38313] {CVE-2023-52791} - firewire: ohci: mask bus reset interrupts between ISR and bottom half (Steve Best) [RHEL-39902] {CVE-2024-36950} - ipv6: init the accept_queue's spinlocks in inet6_create (Guillaume Nault) [RHEL-28899] {CVE-2024-26614} - tcp: make sure init the accept_queue's spinlocks once (Guillaume Nault) [RHEL-28899] {CVE-2024-26614} - tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (Steve Best) [RHEL-39352] {CVE-2024-36016} - mlxsw: spectrum_acl_tcam: Fix incorrect list API usage (Ivan Vecera) [RHEL-37484] {CVE-2024-36006} - pwm: Fix double shift bug (Steve Best) [RHEL-38278] {CVE-2023-52756} - mmc: sdio: fix possible resource leaks in some error paths (Steve Best) [RHEL-38149] {CVE-2023-52730} - of: unittest: Fix compile in the non-dynamic case (Steve Best) [RHEL-37070] {CVE-2023-52679} - of: unittest: Fix of_count_phandle_with_args() expected value message (Steve Best) [RHEL-37070] {CVE-2023-52679} - of: Fix double free in of_parse_phandle_with_args_map (Steve Best) [RHEL-37070] {CVE-2023-52679} - pinctrl: core: delete incorrect free in pinctrl_enable() (Steve Best) [RHEL-39756] {CVE-2024-36940} - pinctrl: core: fix possible memory leak in pinctrl_enable() (Steve Best) [RHEL-39756] {CVE-2024-36940} - media: gspca: cpia1: shift-out-of-bounds in set_flicker (Desnes Nunes) [RHEL-38331] {CVE-2023-52764} - tipc: fix a possible memleak in tipc_buf_append (Xin Long) [RHEL-39881] {CVE-2024-36954} - cifs: fix mid leak during reconnection after timeout threshold (Paulo Alcantara) [RHEL-36222] - cifs: Fix use-after-free in rdata->read_into_pages() (Paulo Alcantara) [RHEL-36222] - cifs: Fix pages leak when writedata alloc failed in cifs_write_from_iter() (Paulo Alcantara) [RHEL-36222] - cifs: Fix pages array leak when writedata alloc failed in cifs_writedata_alloc() (Paulo Alcantara) [RHEL-36222] - cifs: destage dirty pages before re-reading them for cache=none (Paulo Alcantara) [RHEL-36222] - cifs: destage any unwritten data to the server before calling copychunk_write (Paulo Alcantara) [RHEL-36222] - Adjust cifssb maximum read size (Paulo Alcantara) [RHEL-36222] - cifs: make locking consistent around the server session status (Paulo Alcantara) [RHEL-36222] - cifs: fix credit accounting for extra channel (Paulo Alcantara) [RHEL-36222] - smb3: prevent races updating CurrentMid (Paulo Alcantara) [RHEL-36222] - cifs: fix missing spinlock around update to ses->status (Paulo Alcantara) [RHEL-36222] - cifs: use echo_interval even when connection not ready. (Paulo Alcantara) [RHEL-36222] - cifs: detect dead connections only when echoes are enabled. (Paulo Alcantara) [RHEL-36222] - cifs: Fix preauth hash corruption (Paulo Alcantara) [RHEL-36222] - cifs: do not send close in compound create+close requests (Paulo Alcantara) [RHEL-36222] - cifs: ask for more credit on async read/write code paths (Paulo Alcantara) [RHEL-36222] - cifs: use discard iterator to discard unneeded network data more efficiently (Paulo Alcantara) [RHEL-36222] - cifs: Fix in error types returned for out-of-credit situations. (Paulo Alcantara) [RHEL-36222] - smb3: fix crediting for compounding when only one request in flight (Paulo Alcantara) [RHEL-36222] - cifs: New optype for session operations. (Paulo Alcantara) [RHEL-36222] - mm/gup: do not return 0 from pin_user_pages_fast() for bad args (Paulo Alcantara) [RHEL-36222] - wifi: brcmfmac: pcie: handle randbuf allocation failure (Jose Ignacio Tornos Martinez) [RHEL-44124] {CVE-2024-38575} - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). (Guillaume Nault) [RHEL-39835] {CVE-2024-36904} - wifi: mac80211: don't return unset power in ieee80211_get_tx_power() (Jose Ignacio Tornos Martinez) [RHEL-38159] {CVE-2023-52832} - wifi: ath11k: fix gtk offload status event locking (Jose Ignacio Tornos Martinez) [RHEL-38155] {CVE-2023-52777} - net: ieee802154: fix null deref in parse dev addr (Steve Best) [RHEL-38012] {CVE-2021-47257} - mm/hugetlb: fix missing hugetlb_lock for resv uncharge (Rafael Aquini) [RHEL-37465] {CVE-2024-36000} - x86/xen: Add some null pointer checking to smp.c (Vitaly Kuznetsov) [RHEL-33258] {CVE-2024-26908} - x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() (Vitaly Kuznetsov) [RHEL-33258] {CVE-2024-26908} - wifi: cfg80211: check A-MSDU format more carefully (Jose Ignacio Tornos Martinez) [RHEL-37343] {CVE-2024-35937} - wifi: rtw89: fix null pointer access when abort scan (Jose Ignacio Tornos Martinez) [RHEL-37355] {CVE-2024-35946} - atl1c: Work around the DMA RX overflow issue (Ken Cox) [RHEL-38287] {CVE-2023-52834} - wifi: ath11k: decrease MHI channel buffer length to 8KB (Jose Ignacio Tornos Martinez) [RHEL-37339] {CVE-2024-35938} - wifi: iwlwifi: mvm: rfi: fix potential response leaks (Jose Ignacio Tornos Martinez) [RHEL-37163] {CVE-2024-35912} - USB: core: Fix access violation during port device removal (Desnes Nunes) [RHEL-39853] {CVE-2024-36896} - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() (Ewan D. Milne) [RHEL-37123] {CVE-2024-35930} - netfilter: nf_tables: honor table dormant flag from netdev release event path (Phil Sutter) [RHEL-37450] {CVE-2024-36005} - wifi: iwlwifi: mvm: don't set the MFP flag for the GTK (Jose Ignacio Tornos Martinez) [RHEL-36898] {CVE-2024-27434} - wifi: iwlwifi: mvm: Fix key flags for IGTK on AP interface (Jose Ignacio Tornos Martinez) [RHEL-36898] {CVE-2024-27434} - misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspend/resume (Steve Best) [RHEL-36932] {CVE-2024-35824} - [rt] build kernel-rt-4.18.0-553.9.1.rt7.350.el8_10 [RHEL-44553] - x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (Steve Best) [RHEL-37262] {CVE-2024-35876} - net/sched: flower: Fix chain template offload (Xin Long) [RHEL-31313] {CVE-2024-26669} - SUNRPC: fix a memleak in gss_import_v2_context (Scott Mayhew) [RHEL-35195] {CVE-2023-52653} - efivarfs: force RO when remounting if SetVariable is not supported (Pavel Reichl) [RHEL-26564] {CVE-2023-52463} - dmaengine: idxd: add a write() method for applications to submit work (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823} - dmaengine: idxd: add a new security check to deal with a hardware erratum (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823} - VFIO: Add the SPR_DSA and SPR_IAX devices to the denylist (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823} - quota: Fix potential NULL pointer dereference (Pavel Reichl) [RHEL-33219] {CVE-2024-26878} - locking/lockdep: Fix overflow in presentation of average lock-time (Čestmír Kalina) [RHEL-17678] - blk-cgroup: Properly propagate the iostat update up the hierarchy (Ming Lei) [RHEL-40939] - proc: Use new_inode not new_inode_pseudo (Ian Kent) [RHEL-40167] - stmmac: Clear variable when destroying workqueue (Izabela Bakollari) [RHEL-31822] {CVE-2024-26802} - powerpc/pseries/memhp: Fix access beyond end of drmem array (Mamatha Inamdar) [RHEL-26495] {CVE-2023-52451} - platform/x86: wmi: Fix opening of char device (David Arcari) [RHEL-38258] {CVE-2023-52864} - Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" (Kamal Heib) [RHEL-36908] {CVE-2023-52658} - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed (Cathy Avery) [RHEL-39074] - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove (Cathy Avery) [RHEL-39074] - hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes (Cathy Avery) [RHEL-39074] - hv_netvsc: remove duplicated including of slab.h (Cathy Avery) [RHEL-39074] - hv_netvsc: rndis_filter needs to select NLS (Cathy Avery) [RHEL-39074] - hv_netvsc: Mark VF as slave before exposing it to user-mode (Cathy Avery) [RHEL-39074] - hv_netvsc: Fix race of register_netdevice_notifier and VF register (Cathy Avery) [RHEL-39074] - hv_netvsc: fix race of netvsc and VF register_netdevice (Cathy Avery) [RHEL-39074] - hv_netvsc: fix netvsc_send_completion to avoid multiple message length checks (Cathy Avery) [RHEL-39074] - hv_netvsc: Allocate rx indirection table size dynamically (Cathy Avery) [RHEL-39074] - net: hv_netvsc: Fix a warning triggered by memcpy in rndis_filter (Cathy Avery) [RHEL-39074] - gfs2: Fix lru_count accounting (Andreas Gruenbacher) [RHEL-32941] - gfs2: Fix "Make glock lru list scanning safer" (Andreas Gruenbacher) [RHEL-32941] - gfs2: Fix "ignore unlock failures after withdraw" (Andreas Gruenbacher) [RHEL-32941] - gfs2: Don't set GLF_LOCK in gfs2_dispose_glock_lru (Andreas Gruenbacher) [RHEL-32941] - gfs2: Don't forget to complete delayed withdraw (Andreas Gruenbacher) [RHEL-32941] - gfs2: Delay withdraw from atomic context (Andreas Gruenbacher) [RHEL-32941] - gfs2: trivial clean up of gfs2_ail_error (Andreas Gruenbacher) [RHEL-32941] - ext4: fix corruption during on-line resize (Carlos Maiolino) [RHEL-36974] {CVE-2024-35807} - ext4: correct offset of gdb backup in non meta_bg group to update_backups (Carlos Maiolino) [RHEL-36974] - ext4: avoid online resizing failures due to oversized flex bg (Carlos Maiolino) [RHEL-30507] {CVE-2023-52622} - ext4: use time_is_before_jiffies() instead of open coding it (Carlos Maiolino) [RHEL-30507] - ext4: unify the type of flexbg_size to unsigned int (Carlos Maiolino) [RHEL-30507] - ext4: remove unnecessary check from alloc_flex_gd() (Carlos Maiolino) [RHEL-30507] - tracing: Do no increment trace_clock_global() by one (Jerome Marchand) [RHEL-27107] {CVE-2021-46939} - tracing: Restructure trace_clock_global() to never block (Jerome Marchand) [RHEL-27107] {CVE-2021-46939} - net/sched: act_skbmod: prevent kernel-infoleak (Xin Long) [RHEL-37220] {CVE-2024-35893} - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (Xin Long) [RHEL-38307] {CVE-2023-52845} - redhat: remove the merge subtrees script (Derek Barbosa) - redhat: rhdocs: delete .get_maintainer.conf (Derek Barbosa) - redhat: rhdocs: Remove the rhdocs directory (Derek Barbosa) - dyndbg: fix old BUG_ON in >control parser (Waiman Long) [RHEL-37111] {CVE-2024-35947} - dyndbg: let query-modname override actual module name (Waiman Long) [RHEL-37111] - dyndbg: make dyndbg a known cli param (Waiman Long) [RHEL-37111] - lan78xx: Fix exception on link speed change (Jamie Bainbridge) [RHEL-33437] - net: usb: lan78xx: don't modify phy_device state concurrently (Jamie Bainbridge) [RHEL-33437] - efi: runtime: Fix potential overflow of soft-reserved region size (Lenny Szubowicz) [RHEL-33096] {CVE-2024-26843} - perf/arm-cmn: Fail DTC counter allocation correctly (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Rework DTC counters (again) (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Fix DTC domain detection (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Revamp model detection (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Fix port detection for CMN-700 (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Move overlapping wp_combine field (Michael Petlan) [RHEL-23841] - Partially revert "perf/arm-cmn: Optimise DTC counter accesses" (Michael Petlan) [RHEL-23841] - drivers/perf: Compile with gnu99 standard (Michael Petlan) [RHEL-23841] - x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (Steve Best) [RHEL-36994] {CVE-2024-35801} - watchdog: softdog: Add options 'soft_reboot_cmd' and 'soft_active_on_boot' (Waiman Long) [RHEL-19723] - tipc: fix UAF in error path (Xin Long) [RHEL-34278] {CVE-2024-36886} - [rt] build kernel-rt-4.18.0-553.8.1.rt7.349.el8_10 [RHEL-40882] - udf: Fix NULL pointer dereference in udf_symlink function (Pavel Reichl) [RHEL-37769] {CVE-2021-47353} - net: ti: fix UAF in tlan_remove_one (Jose Ignacio Tornos Martinez) [RHEL-38940] {CVE-2021-47310} - ARM: footbridge: fix PCI interrupt mapping (Myron Stowe) [RHEL-26971] {CVE-2021-46909} - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (Kamal Heib) [RHEL-37454] {CVE-2024-36004} - net/mlx5e: Fix mlx5e_priv_init() cleanup flow (Kamal Heib) [RHEL-37424] {CVE-2024-35959} - net/mlx5: Properly link new fs rules into the tree (Kamal Heib) [RHEL-37420] {CVE-2024-35960} - net/mlx5e: fix a potential double-free in fs_any_create_groups (Kamal Heib) [RHEL-37091] {CVE-2023-52667} - net: ena: Fix incorrect descriptor free behavior (Kamal Heib) [RHEL-37428] {CVE-2024-35958} - mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - mISDN: fix possible use-after-free in HFC_cleanup() (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - implement dh fallback for primes > 4K (Vladis Dronov) [RHEL-35106] - crypto: qat - avoid division by zero (Vladis Dronov) [RHEL-35106] - crypto: qat - resolve race condition during AER recovery (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - use kcalloc_node() instead of kzalloc_node() (Vladis Dronov) [RHEL-35106] - [rt] Enable CONFIG_DRM_MGAG200_DISABLE_WRITECOMBINE (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Add an option to disable Write-Combine (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Fix caching setup for remapped video memory (Jocelyn Falempe) [RHEL-36172] - Revert "drm/mgag200: Add a workaround for low-latency" (Jocelyn Falempe) [RHEL-36172] - mptcp: fix data re-injection from stale subflow (Davide Caratti) [RHEL-33133] {CVE-2024-26826} - ipv6: sr: fix incorrect unregister order (Hangbin Liu) [RHEL-31730] - ipv6: sr: fix possible use-after-free and null-ptr-deref (Hangbin Liu) [RHEL-31730] {CVE-2024-26735} - net/bnx2x: Prevent access to a freed page in page_pool (Michal Schmidt) [RHEL-14195 RHEL-33243] {CVE-2024-26859} - bnx2x: new flag for track HW resource allocation (Michal Schmidt) [RHEL-14195 RHEL-33243] - bnx2x: fix page fault following EEH recovery (Michal Schmidt) [RHEL-14195 RHEL-33243] - x86: KVM: SVM: always update the x2avic msr interception (Maxim Levitsky) [RHEL-15495] {CVE-2023-5090} - EDAC/thunderx: Fix possible out-of-bounds string access (Aristeu Rozanski) [RHEL-26573] {CVE-2023-52464} - [rt] build kernel-rt-4.18.0-553.7.1.rt7.348.el8_10 [RHEL-34640] - net: qcom/emac: fix UAF in emac_remove (Ken Cox) [RHEL-37834] {CVE-2021-47311} - perf/core: Bail out early if the request AUX area is out of bound (Michael Petlan) [RHEL-38268] {CVE-2023-52835} - crypto: pcrypt - Fix hungtask for PADATA_RESET (Herbert Xu) [RHEL-38171] {CVE-2023-52813} - drm/amdgpu: fix use-after-free bug (Jocelyn Falempe) [RHEL-31240] {CVE-2024-26656} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash (Ivan Vecera) [RHEL-37008] {CVE-2024-35854} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update (Ivan Vecera) [RHEL-37004] {CVE-2024-35855} - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (Ivan Vecera) [RHEL-37012] {CVE-2024-35853} - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work (Ivan Vecera) [RHEL-37016] {CVE-2024-35852} - mlxsw: spectrum_acl_tcam: Fix warning during rehash (Ivan Vecera) [RHEL-37480] {CVE-2024-36007} - can: peak_pci: peak_pci_remove(): fix UAF (Jose Ignacio Tornos Martinez) [RHEL-38419] {CVE-2021-47456} - usbnet: fix error return code in usbnet_probe() (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - usbnet: sanity check for maxpacket (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - net/mlx5e: fix a double-free in arfs_create_groups (Kamal Heib) [RHEL-36920] {CVE-2024-35835} - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds (Jose Ignacio Tornos Martinez) [RHEL-38220] {CVE-2023-52878} - net: cdc_eem: fix tx fixup skb leak (Jose Ignacio Tornos Martinez) [RHEL-38080] {CVE-2021-47236} - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Jose Ignacio Tornos Martinez) [RHEL-38113] {CVE-2023-52703} - usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() (Desnes Nunes) [RHEL-38248] {CVE-2023-52877} - usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (Desnes Nunes) [RHEL-38240] {CVE-2023-52781} - gro: fix ownership transfer (Xin Long) [RHEL-37226] {CVE-2024-35890} - tipc: fix kernel warning when sending SYN message (Xin Long) [RHEL-38109] {CVE-2023-52700} - erspan: make sure erspan_base_hdr is present in skb->head (Xin Long) [RHEL-37230] {CVE-2024-35888} - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() (Bryan Gurney) [RHEL-17366] - scsi: mpi3mr: Sanitise num_phys (Bryan Gurney) [RHEL-17366] - netfilter: nf_tables: use timestamp to check for set element timeout (Phil Sutter) [RHEL-38023] {CVE-2024-27397} - net/ipv6: SKB symmetric hash should incorporate transport ports (Sabrina Dubroca) [RHEL-32061] - crypto: s390/aes - Fix buffer overread in CTR mode (Herbert Xu) [RHEL-37089] {CVE-2023-52669} - net: Save and restore msg_namelen in sock_sendmsg (Jamie Bainbridge) [RHEL-35893] - net: prevent address rewrite in kernel_bind() (Jamie Bainbridge) [RHEL-35893] - net: prevent rewrite of msg_name in sock_sendmsg() (Jamie Bainbridge) [RHEL-35893] - net: replace calls to sock->ops->connect() with kernel_connect() (Jamie Bainbridge) [RHEL-35893] - net: Avoid address overwrite in kernel_connect (Jamie Bainbridge) [RHEL-35893] - wifi: iwlwifi: dbg-tlv: ensure NUL termination (Jose Ignacio Tornos Martinez) [RHEL-37026] {CVE-2024-35845} - wifi: mac80211: fix potential sta-link leak (Jose Ignacio Tornos Martinez) [RHEL-36916] {CVE-2024-35838} - wifi: nl80211: reject iftype change with mesh ID change (Jose Ignacio Tornos Martinez) [RHEL-36884] {CVE-2024-27410} - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (Jose Ignacio Tornos Martinez) [RHEL-36807] {CVE-2024-35789} - Bluetooth: Avoid potential use-after-free in hci_error_reset (David Marlin) [RHEL-31826] {CVE-2024-26801} - tls: disable async encrypt/decrypt (Sabrina Dubroca) [RHEL-26362 RHEL-26409 RHEL-26420] {CVE-2024-26585 CVE-2024-26583 CVE-2024-26584} - Squashfs: check the inode number is not the invalid value of zero (Phillip Lougher) [RHEL-35096] {CVE-2024-26982} - ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/msg.c: update and document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/sem.c: document and update memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: update/document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: remove duplicated code (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (Kamal Heib) [RHEL-30582] {CVE-2023-52626} - Revert "ACPI: bus: Rework system-level device notification handling" (Prarit Bhargava) [RHEL-21486] - hwrng: core - Fix page fault dead lock on mmap-ed hwrng (Prarit Bhargava) [RHEL-29485] {CVE-2023-52615} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - powerpc/pseries: pci - logic bug (Mamatha Inamdar) [RHEL-240146] - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228} - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899] {CVE-2026-90036} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680] {CVE-2026-72262} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641} - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781] {CVE-2026-74583} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916] {CVE-2026-68377} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271288] {CVE-2026-89631} - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280060] {CVE-2026-98320} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271853] {CVE-2026-93817} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191034] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191034] {CVE-2026-53196} - gfs2: a minor finish_xmote cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor run_queue fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: only apply DLM_LKF_VALBLK if sb_lvbptr is not NULL (Alexander Aring) [RHEL-129363] - gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Use wait_event_freezable_timeout() for freezable kthread (Andreas Gruenbacher) [RHEL-129363] - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-129363] - gfs2: low-memory forced flush fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: add missing withdraw locking (Andreas Gruenbacher) [RHEL-129363] - gfs2: Disable GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename "gfs_recovery" workqueue to "gfs2_recovery" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-129363] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-129363] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify do_promote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-129363] - gfs2: introduce new gfs2_glock_assert_withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify refcounting in do_xmote (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Make recovery error more readable (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark the remaining process-independent glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark flock glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of newlines in log messages (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-129363] - gfs2: Sanitize kthread stopping (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix logd wakeup on I/O error (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_quotad (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_logd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove duplicate check in do_xmote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove space before newline (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix LM_FLAG_TRY* logic in add_to_queue (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove DLM_LKF_ALTCW / DLM_LKF_ALTPR code (Andreas Gruenbacher) [RHEL-129363] - gfs2: Further sanitize lock_dlm.c (Andreas Gruenbacher) [RHEL-129363] - gfs2: sanitize the gdlm_ast -> finish_xmote interface (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify DLM_LKF_QUECVT use (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-129363] - gfs2: Lift withdraw check out of gfs2_ail1_empty (Andreas Gruenbacher) [RHEL-129363] - gfs2: don't withdraw if init_threads() got interrupted (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-129363] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix slab-use-after-free in gfs2_qd_dealloc (Andreas Gruenbacher) [RHEL-129363] {CVE-2023-52760} - gfs2: Fix asynchronous thread destruction (Andreas Gruenbacher) [RHEL-129363] - gfs2: Stop using gfs2_make_fs_ro for withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-129363] - gfs2: Turn gfs2_withdraw into a void function (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark withdraws as unlikely (Andreas Gruenbacher) [RHEL-129363] - gfs2: ignore rindex_update failure in dinode_dealloc (Andreas Gruenbacher) [RHEL-129363] - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270732] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256684] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256684] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256684] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271657] {CVE-2026-93288} - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254282] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-263292] {CVE-2026-89479} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254357] {CVE-2026-74588} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222954] {CVE-2026-52935} - powerpc/pseries: pci - logic bug (Mamatha Inamdar) [RHEL-240146] - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228} - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899] {CVE-2026-90036} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680] {CVE-2026-72262} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641} - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781] {CVE-2026-74583} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916] {CVE-2026-68377} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270905] {CVE-2026-89777} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263644] {CVE-2026-68202} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254200] {CVE-2026-80590} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233134] {CVE-2026-64572} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225459] {CVE-2026-64114} - xfs: bounds-check buffer log item's dirty bitmap (CKI Backport Bot) [RHEL-253365] {CVE-2026-80536} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234242] {CVE-2026-64266} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271288] {CVE-2026-89631} - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280060] {CVE-2026-98320} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271853] {CVE-2026-93817} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191034] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191034] {CVE-2026-53196} - gfs2: a minor finish_xmote cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor run_queue fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: only apply DLM_LKF_VALBLK if sb_lvbptr is not NULL (Alexander Aring) [RHEL-129363] - gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Use wait_event_freezable_timeout() for freezable kthread (Andreas Gruenbacher) [RHEL-129363] - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-129363] - gfs2: low-memory forced flush fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: add missing withdraw locking (Andreas Gruenbacher) [RHEL-129363] - gfs2: Disable GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename "gfs_recovery" workqueue to "gfs2_recovery" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-129363] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-129363] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify do_promote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-129363] - gfs2: introduce new gfs2_glock_assert_withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify refcounting in do_xmote (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Make recovery error more readable (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark the remaining process-independent glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark flock glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of newlines in log messages (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-129363] - gfs2: Sanitize kthread stopping (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix logd wakeup on I/O error (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_quotad (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_logd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove duplicate check in do_xmote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove space before newline (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix LM_FLAG_TRY* logic in add_to_queue (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove DLM_LKF_ALTCW / DLM_LKF_ALTPR code (Andreas Gruenbacher) [RHEL-129363] - gfs2: Further sanitize lock_dlm.c (Andreas Gruenbacher) [RHEL-129363] - gfs2: sanitize the gdlm_ast -> finish_xmote interface (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify DLM_LKF_QUECVT use (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-129363] - gfs2: Lift withdraw check out of gfs2_ail1_empty (Andreas Gruenbacher) [RHEL-129363] - gfs2: don't withdraw if init_threads() got interrupted (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-129363] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix slab-use-after-free in gfs2_qd_dealloc (Andreas Gruenbacher) [RHEL-129363] {CVE-2023-52760} - gfs2: Fix asynchronous thread destruction (Andreas Gruenbacher) [RHEL-129363] - gfs2: Stop using gfs2_make_fs_ro for withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-129363] - gfs2: Turn gfs2_withdraw into a void function (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark withdraws as unlikely (Andreas Gruenbacher) [RHEL-129363] - gfs2: ignore rindex_update failure in dinode_dealloc (Andreas Gruenbacher) [RHEL-129363] - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270732] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256684] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256684] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256684] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271657] {CVE-2026-93288} - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254282] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-263292] {CVE-2026-89479} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254357] {CVE-2026-74588} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222954] {CVE-2026-52935} - powerpc/pseries: pci - logic bug (Mamatha Inamdar) [RHEL-240146] - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228} - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899] {CVE-2026-90036} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680] {CVE-2026-72262} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641} - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781] {CVE-2026-74583} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916] {CVE-2026-68377} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - [rt] build kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 [RHEL-53529] - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071} - [rt] build kernel-rt-4.18.0-553.21.1.rt7.362.el8_10 [RHEL-53529] - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874] - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558} - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441} - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904} - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322} - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246} - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008} - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228} - [rt] build kernel-rt-4.18.0-553.20.1.rt7.361.el8_10 [RHEL-53529] - KVM: arm64: Disassociate vcpus from redistributor region on teardown (Shaoqin Huang) [RHEL-48417] {CVE-2024-40989} - devres: Fix memory leakage caused by driver API devm_free_percpu() (CKI Backport Bot) [RHEL-55597] {CVE-2024-43871} - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (Izabela Bakollari) [RHEL-26680] {CVE-2024-26600} - nvmet-fc: avoid deadlock on delete association path (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - nvmet-fc: release reference on target port (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - ACPI: LPIT: Avoid u32 multiplication overflow (Mark Langsdorf) [RHEL-37062] {CVE-2023-52683} - sched/deadline: Fix task_struct reference leak (Phil Auld) [RHEL-50904] {CVE-2024-41023} - nfsd: fix crash on LOCKT on reexported NFSv3 (Benjamin Coddington) [RHEL-31515] - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path (CKI Backport Bot) [RHEL-26570] {CVE-2024-26595} - mlxsw: spectrum_acl_tcam: Move devlink param to TCAM code (Ivan Vecera) [RHEL-26570] {CVE-2024-26595} - ACPI: extlog: fix NULL pointer dereference check (Mark Langsdorf) [RHEL-29110] {CVE-2023-52605} - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() (Mark Langsdorf) [RHEL-33198] {CVE-2024-26894} - mm: prevent derefencing NULL ptr in pfn_section_valid() (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - mm, kmsan: fix infinite recursion due to RCU critical section (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - cipso: make cipso_v4_skbuff_delattr() fully remove the CIPSO options (Ondrej Mosnacek) [RHEL-30904] - cipso: fix total option length computation (Ondrej Mosnacek) [RHEL-30904] - ext4: do not create EA inode under buffer lock (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: check the return value of ext4_xattr_inode_dec_ref() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (Carlos Maiolino) [RHEL-48507] {CVE-2024-40998} - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - [rt] build kernel-rt-4.18.0-553.19.1.rt7.360.el8_10 [RHEL-53529] - drm/i915/vma: Fix UAF on destroy against retire race (Mika Penttilä) [RHEL-35222] {CVE-2024-26939} - RHEL-48620 (Kenneth Yin) [RHEL-48620] - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (CKI Backport Bot) [RHEL-42721] {CVE-2024-26855} - net: usb: asix: do not force pause frames support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix "can't send until first packet is send" issue (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix modprobe "sysfs: cannot create duplicate filename" (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: add proper error handling of usb read errors (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix wrong return value in asix_check_host_enable() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix uninit-value in asix_mdio_read() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: fix boolconv.cocci warnings (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: do not call phy_disconnect() for ax88178 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: move embedded PHY detection as early as possible (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix uninit value bugs (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add missing stop (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: suspend PHY on driver probe (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: manage PHY PM from MAC (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: add error handling for asix_mdio_* functions (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add phylib support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: refactor asix_read_phy_addr() and handle errors on return (Ken Cox) [RHEL-28108] {CVE-2021-47101} - SUNRPC: always free ctxt when freeing deferred request (Jay Shin) [RHEL-40936] - SUNRPC: double free xprt_ctxt while still in use (Jay Shin) [RHEL-40936] - SUNRPC: Remove svc_rqst::rq_xprt_hlen (Jay Shin) [RHEL-40936] - SUNRPC: Remove dead code in svc_tcp_release_rqst() (Jay Shin) [RHEL-40936] - x86/bugs: Extend VMware Retbleed workaround to Nehalem & earlier CPUs (Waiman Long) [RHEL-48646] - wifi: iwlwifi: read txq->read_ptr under lock (Jose Ignacio Tornos Martinez) [RHEL-39797] {CVE-2024-36922} - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (John Meneghini) [RHEL-39908] {CVE-2024-36919} - nbd: always initialize struct msghdr completely (Ming Lei) [RHEL-29498] {CVE-2024-26638} - block: don't call rq_qos_ops->done_bio if the bio isn't tracked (Ming Lei) [RHEL-42151] {CVE-2021-47412} - nvmet: fix a possible leak when destroy a ctrl during qp establishment (Maurizio Lombardi) [RHEL-52013] {CVE-2024-42152} - ipv6: prevent NULL dereference in ip6_output() (Sabrina Dubroca) [RHEL-39912] {CVE-2024-36901} - ppp: reject claimed-as-LCP but actually malformed packets (Guillaume Nault) [RHEL-51052] {CVE-2024-41044} - leds: trigger: Unregister sysfs attributes before calling deactivate() (CKI Backport Bot) [RHEL-54834] {CVE-2024-43830} - crypto: bcm - Fix pointer arithmetic (cki-backport-bot) [RHEL-44108] {CVE-2024-38579} - scsi: qedf: Ensure the copied buf is NUL terminated (John Meneghini) [RHEL-44195] {CVE-2024-38559} - x86/bhi: Avoid warning in #DB handler due to BHI mitigation (Waiman Long) [RHEL-53657] {CVE-2024-42240} - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (CKI Backport Bot) [RHEL-47529] {CVE-2024-40901} - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (CKI Backport Bot) [RHEL-39843] {CVE-2024-36902} - net: usb: ax88179_178a: improve link status logs (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: improve reset check (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: fix link status when link is set to down/up (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: avoid writing the mac address before first reading (Jose Ignacio Tornos Martinez) [RHEL-45167] - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - media: cec: cec-api: add locking in cec_release() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid confusing "transmit timed out" message (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid recursive cec_claim_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: remove length check of Timer Status (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: count low-drive, error and arb-lost conditions (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add note about *_from_edid() function usage in drm (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_unconfigured() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_nb_transmit_canceled() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: don't set last_initiator if tx in progress (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: disable adapter in cec_devnode_unregister (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: not all messages were passed on when monitoring (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add support for Absolute Volume Control (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: log when claiming LA fails unexpectedly (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: drop activate_cnt, use state info instead (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: reconfigure if the PA changes during configuration (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: fix is_configuring state (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: stop trying LAs on CEC_TX_STATUS_TIMEOUT (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't unconfigure if already unconfigured (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add optional adap_configured callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add xfer_timeout_ms field (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: use call_op and check for !unregistered (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix interrupt en/disable handling (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: drop unused 'enabled' field from struct cec_pin (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix off-by-one SFT check (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: rename timer overrun variables (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: correctly pass on reply results (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: abort if the current transmit was canceled (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: call enable_adap on s_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: media/cec.h: document cec_adapter fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix a deadlock situation (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: safely unhook lists in cec_data (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: copy sequence field for the reply (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix trivial style warnings (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: add 'unregistered' checks (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't use flush_scheduled_work() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: Use fallthrough pseudo-keyword (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: remove unused waitq and phys_addrs fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: silence shift wrapping warning in __cec_s_log_addrs() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: move the core to a separate directory (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - net/iucv: Avoid explicit cpumask var allocation on stack (CKI Backport Bot) [RHEL-51631] {CVE-2024-42094} - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (Dick Kennedy) [RHEL-40400] - KVM: selftests: Make hyperv_clock require TSC based system clocksource (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Run clocksource dependent tests with hyperv_clocksource_tsc_page too (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Use generic sys_clocksource_is_tsc() in vmx_nested_tsc_scaling_test (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Generalize check_clocksource() from kvm_clock_test (Vitaly Kuznetsov) [RHEL-19027] - firmware: cs_dsp: Return error if block header overflows file (CKI Backport Bot) [RHEL-53646] {CVE-2024-42238} - firmware: cs_dsp: Validate payload length before processing block (CKI Backport Bot) [RHEL-53638] {CVE-2024-42237} - mm, slub: fix potential memoryleak in kmem_cache_open() (Waiman Long) [RHEL-38404] {CVE-2021-47466} - slub: don't panic for memcg kmem cache creation failure (Waiman Long) [RHEL-38404] {CVE-2021-47466} - wifi: ath11k: fix htt pktlog locking (Jose Ignacio Tornos Martinez) [RHEL-38317] {CVE-2023-52800} - wifi: ath11k: fix dfs radar event locking (Jose Ignacio Tornos Martinez) [RHEL-38165] {CVE-2023-52798} - lib/generic-radix-tree.c: Don't overflow in peek() (Waiman Long) [RHEL-37737] {CVE-2021-47432} - include/linux/generic-radix-tree.h: replace kernel.h with the necessary inclusions (Waiman Long) [RHEL-37737] {CVE-2021-47432} - EDAC/i10nm: Skip the absent memory controllers (Aristeu Rozanski) [RHEL-43236] - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (John Meneghini) [RHEL-38197] {CVE-2023-52809} - gfs2: Fix potential glock use-after-free on unmount (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: simplify gdlm_put_lock with out_free label (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: Remove ill-placed consistency check (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - nvme-fc: do not wait in vain when unloading module (Ewan D. Milne) [RHEL-33083] {CVE-2024-26846} - HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts (CKI Backport Bot) [RHEL-49698] {CVE-2022-48866} - scsi: qedf: Set qed_slowpath_params to zero before use (John Meneghini) [RHEL-9797] - scsi: qedf: Wait for stag work during unload (John Meneghini) [RHEL-9797] - scsi: qedf: Don't process stag work during unload and recovery (John Meneghini) [RHEL-9797] - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - mm: avoid overflows in dirty throttling logic (Audra Mitchell) [RHEL-51840] {CVE-2024-42131} - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - ACPI: fix NULL pointer dereference (Mark Langsdorf) [RHEL-37897] {CVE-2021-47289} - [rt] build kernel-rt-4.18.0-553.18.1.rt7.359.el8_10 [RHEL-53529] - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING (Ewan D. Milne) [RHEL-39805] {CVE-2024-36920} - tun: limit printing rate when illegal packet received by tun dev (Jon Maloy) [RHEL-35046] {CVE-2024-27013} - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu/mes: fix use-after-free issue (Michel Dänzer) [RHEL-44043] {CVE-2024-38581} - drm/amdgpu: Fix the null pointer when load rlc firmware (Michel Dänzer) [RHEL-30603] {CVE-2024-26649} - drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (Michel Dänzer) [RHEL-35160] {CVE-2024-27042} - net/sched: Fix UAF when resolving a clash (Xin Long) [RHEL-51014] {CVE-2024-41040} - tcp_metrics: validate source addr length (Guillaume Nault) [RHEL-52025] {CVE-2024-42154} - NFSv4/pnfs: Fix a use-after-free bug in open (Benjamin Coddington) [RHEL-35508] - NFSv4: Don't hold the layoutget locks across multiple RPC calls (Benjamin Coddington) [RHEL-35508] - scsi: qedf: Make qedf_execute_tmf() non-preemptible (John Meneghini) [RHEL-51799] {CVE-2024-42124} - Input: elantech - fix stack out of bound access in elantech_change_report_id() (CKI Backport Bot) [RHEL-41938] {CVE-2021-47097} - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (CKI Backport Bot) [RHEL-28982] {CVE-2023-52478} - drm/radeon: fix UBSAN warning in kv_dpm.c (CKI Backport Bot) [RHEL-48399] {CVE-2024-40988} - usb: core: Don't hold the device lock while sleeping in do_proc_control() (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - USB: core: Make do_proc_control() and do_proc_bulk() killable (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - scsi: qedi: Fix crash while reading debugfs attribute (CKI Backport Bot) [RHEL-48327] {CVE-2024-40978} - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CKI Backport Bot) [RHEL-48309] {CVE-2024-40977} - net: tcp: accept old ack during closing (Jamie Bainbridge) [RHEL-52433] - wifi: iwlwifi: mvm: don't read past the mfuart notifcation (CKI Backport Bot) [RHEL-48016] {CVE-2024-40941} - net/iucv: fix use after free in iucv_sock_close() (Mete Durlu) [RHEL-53988] - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (CKI Backport Bot) [RHEL-47908] {CVE-2024-40929} - Input: aiptek - properly check endpoint type (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - use descriptors of current altsetting (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - fix endpoint sanity check (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB (CKI Backport Bot) [RHEL-52373] {CVE-2024-42226} - wifi: mt76: replace skb_put with skb_put_zero (CKI Backport Bot) [RHEL-52366] {CVE-2024-42225} - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (CKI Backport Bot) [RHEL-47776] {CVE-2024-40912} - wifi: cfg80211: Lock wiphy in cfg80211_get_station (CKI Backport Bot) [RHEL-47758] {CVE-2024-40911} - VMCI: Use struct_size() in kmalloc() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() (Steve Best) [RHEL-37325] {CVE-2024-35944} - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values (Jose Ignacio Tornos Martinez) [RHEL-51761] {CVE-2024-42114} - usb: atm: cxacru: fix endpoint checking in cxacru_bind() (CKI Backport Bot) [RHEL-51442] {CVE-2024-41097} - nfs: handle error of rpc_proc_register() in init_nfs_fs() (Scott Mayhew) [RHEL-39904] {CVE-2024-36939} - drm/radeon: check bo_va->bo is non-NULL before using it (CKI Backport Bot) [RHEL-51184] {CVE-2024-41060} - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). (CKI Backport Bot) [RHEL-51027] {CVE-2024-41041} - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (CKI Backport Bot) [RHEL-50961] {CVE-2024-41035} - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). (CKI Backport Bot) [RHEL-44408] {CVE-2024-37356} - tcp: avoid too many retransmit packets (Florian Westphal) [RHEL-48627] {CVE-2024-41007} - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() (Florian Westphal) [RHEL-48627] - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Florian Westphal) [RHEL-48627] - tcp: refactor tcp_retransmit_timer() (Florian Westphal) [RHEL-48627] - tcp: exit if nothing to retransmit on RTO timeout (Florian Westphal) [RHEL-48627] - netfilter: nf_tables: Reject tables of unsupported family (Florian Westphal) [RHEL-21418] {CVE-2023-6040} - [rt] build kernel-rt-4.18.0-553.17.1.rt7.358.el8_10 [RHEL-53529] - kyber: fix out of bounds access when preempted (Ming Lei) [RHEL-27258] {CVE-2021-46984} - vfs: don't mod negative dentry count when on shrinker list (Brian Foster) [RHEL-35874] - fs/dcache: Re-use value stored to dentry->d_flags instead of re-reading (Brian Foster) [RHEL-35874] - fbmem: Do not delete the mode that is still in use (CKI Backport Bot) [RHEL-37796] {CVE-2021-47338} - netpoll: Fix race condition in netpoll_owner_active (CKI Backport Bot) [RHEL-49361] {CVE-2024-41005} - firmware: arm_scpi: Fix string overflow in SCPI genpd driver (Mark Salter) [RHEL-43702] {CVE-2021-47609} - ipv6: prevent possible NULL dereference in rt6_probe() (Guillaume Nault) [RHEL-48149] {CVE-2024-40960} - HID: i2c-hid-of: fix NULL-deref on failed power up (CKI Backport Bot) [RHEL-31598] {CVE-2024-26717} - cpufreq: amd-pstate: fix memory leak on CPU EPP exit (CKI Backport Bot) [RHEL-48489] {CVE-2024-40997} - x86/mm/pat: fix VM_PAT handling in COW mappings (Chris von Recklinghausen) [RHEL-37258] {CVE-2024-35877} - PCI/PM: Drain runtime-idle callbacks before driver removal (Myron Stowe) [RHEL-42937] {CVE-2024-35809} - PCI: Drop pci_device_remove() test of pci_dev->driver (Myron Stowe) [RHEL-42937] {CVE-2024-35809} - drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() (Mika Penttilä) [RHEL-26909] {CVE-2023-52470} - USB: core: Fix hang in usb_kill_urb by adding memory barriers (Desnes Nunes) [RHEL-43979] {CVE-2022-48760} - cifs: fix bad fids sent over wire (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB311_posix_mkdir (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB2_tcon (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB2_open (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB2_ioctl (Paulo Alcantara) [RHEL-52517] - selftests: forwarding: devlink_lib: Wait for udev events after reloading (Mark Langsdorf) [RHEL-47642] {CVE-2024-39501} - drivers: core: synchronize really_probe() and dev_uevent() (Mark Langsdorf) [RHEL-47642] {CVE-2024-39501} - udp: do not accept non-tunnel GSO skbs landing in a tunnel (Xin Long) [RHEL-42997] {CVE-2024-35884} - filelock: Remove locks reliably when fcntl/close race is detected (Bill O'Donnell) [RHEL-50170] {CVE-2024-41012} - Input: add bounds checking to input_set_capability() (Benjamin Tissoires) [RHEL-21413] {CVE-2022-48619} - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() (CKI Backport Bot) [RHEL-48130] {CVE-2024-40959} - blk-cgroup: fix list corruption from reorder of WRITE ->lqueued (Ming Lei) [RHEL-33695] - blk-cgroup: fix list corruption from resetting io stat (Ming Lei) [RHEL-33695] - net: do not leave a dangling sk pointer, when socket creation fails (CKI Backport Bot) [RHEL-48060] {CVE-2024-40954} - perf/x86/lbr: Filter vsyscall addresses (Michael Petlan) [RHEL-28991] {CVE-2023-52476} - vmci: prevent speculation leaks by sanitizing event in event_deliver() (CKI Backport Bot) [RHEL-47678] {CVE-2024-39499} - serial: core: fix transmit-buffer reset and memleak (Steve Best) [RHEL-38731] {CVE-2021-47527} - powerpc/pseries: Whitelist dtl slub object for copying to userspace (Mamatha Inamdar) [RHEL-51236] {CVE-2024-41065} - powerpc/eeh: avoid possible crash when edev->pdev changes (Mamatha Inamdar) [RHEL-51220] {CVE-2024-41064} - x86: stop playing stack games in profile_pc() (Steve Best) [RHEL-51643] {CVE-2024-42096} - mptcp: ensure snd_una is properly initialized on connect (Florian Westphal) [RHEL-47933 RHEL-47934] {CVE-2024-40931} - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet (CKI Backport Bot) [RHEL-47492] {CVE-2024-39506} - tun: add missing verification for short frame (Patrick Talbert) [RHEL-50194] {CVE-2024-41091} - tap: add missing verification for short frame (Patrick Talbert) [RHEL-50279] {CVE-2024-41090} - usb-storage: alauda: Check whether the media is initialized (Desnes Nunes) [RHEL-43708] {CVE-2024-38619} - usb-storage: alauda: Fix uninit-value in alauda_check_media() (Desnes Nunes) [RHEL-43708] {CVE-2024-38619} - hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37723] {CVE-2021-47384} - block: fix that util can be greater than 100% (Ming Lei) [RHEL-23074] - block: support to account io_ticks precisely (Ming Lei) [RHEL-23074] - watchdog: Fix possible use-after-free by calling del_timer_sync() (Steve Best) [RHEL-38795] {CVE-2021-47321} - hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37719] {CVE-2021-47385} - mlxsw: spectrum: Protect driver from buggy firmware (CKI Backport Bot) [RHEL-42245] {CVE-2021-47560} - mlxsw: Verify the accessed index doesn't exceed the array length (CKI Backport Bot) [RHEL-42245] {CVE-2021-47560} - dm: call the resume method on internal suspend (Benjamin Marzinski) [RHEL-41835] {CVE-2024-26880} - tty: Fix out-of-bound vmalloc access in imageblit (Steve Best) [RHEL-37727] {CVE-2021-47383} - hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37715] {CVE-2021-47386} - hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs (Steve Best) [RHEL-37710] {CVE-2021-47393} - nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells (Steve Best) [RHEL-38436] {CVE-2021-47497} - driver core: auxiliary bus: Fix memory leak when driver_register() fail (Steve Best) [RHEL-37901] {CVE-2021-47287} - phylib: fix potential use-after-free (cki-backport-bot) [RHEL-43764] {CVE-2022-48754} - ptp: Fix possible memory leak in ptp_clock_register() (Hangbin Liu) [RHEL-38424] {CVE-2021-47455} - NFSv4: Fix memory leak in nfs4_set_security_label (CKI Backport Bot) [RHEL-51315] {CVE-2024-41076} - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER (CKI Backport Bot) [RHEL-51618] {CVE-2024-42090} - ftruncate: pass a signed offset (CKI Backport Bot) [RHEL-51598] {CVE-2024-42084} - af_unix: Fix garbage collector racing against connect() (Felix Maurer) [RHEL-34225] {CVE-2024-26923} - virtio-net: Add validation for used length (Laurent Vivier) [RHEL-42080] {CVE-2021-47352} - net: fix possible store tearing in neigh_periodic_work() (Antoine Tenart) [RHEL-42359] {CVE-2023-52522} - tunnels: fix out of bounds access when building IPv6 PMTU error (Antoine Tenart) [RHEL-41823] {CVE-2024-26665} - vt_ioctl: fix array_index_nospec in vt_setactivate (John W. Linville) [RHEL-49141] {CVE-2022-48804} - Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() (CKI Backport Bot) [RHEL-38302] {CVE-2023-52840} - netns: Make get_net_ns() handle zero refcount net (Antoine Tenart) [RHEL-48105] {CVE-2024-40958} - tracing: Ensure visibility when inserting an element into tracing_map (Michael Petlan) [RHEL-30457] {CVE-2024-26645} - KVM: s390: fix LPSWEY handling (CKI Backport Bot) [RHEL-50072] - firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files (CKI Backport Bot) [RHEL-51144] {CVE-2024-41056} - SUNRPC: Fix a race to wake a sync task (Benjamin Coddington) [RHEL-11843] - firmware: cs_dsp: Fix overflow checking of wmfw header (CKI Backport Bot) [RHEL-50999] {CVE-2024-41039} - firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers (CKI Backport Bot) [RHEL-50987] {CVE-2024-41038} - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (Xin Long) [RHEL-48471] {CVE-2024-40995} - net: fix out-of-bounds access in ops_init (Xin Long) [RHEL-43185] {CVE-2024-36883} - x86/mce/therm_throt: Undo thermal polling properly on CPU offline (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Do not access uninitialized therm_work (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Mark throttle_active_work() as __maybe_unused (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Mask out read-only and reserved MSR bits (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Optimize notifications of thermal throttle (Steve Best) [RHEL-45310] - jiffies: add utility function to calculate delta in ms (Steve Best) [RHEL-45310] - x86/mce: Lower throttling MCE messages' priority to warning (Steve Best) [RHEL-45310] - dmaengine: idxd: Fix oops during rmmod on single-CPU platforms (Eder Zulian) [RHEL-37361] {CVE-2024-35989} - xfs: don't walk off the end of a directory data block (CKI Backport Bot) [RHEL-50879] {CVE-2024-41013} - xfs: add bounds checking to xlog_recover_process_data (CKI Backport Bot) [RHEL-50856] {CVE-2024-41014} - dm-crypt: limit the size of encryption requests (Benjamin Marzinski) [RHEL-29330] - netfilter: flowtable: remove nf_ct_l4proto_find() call (Florian Westphal) [RHEL-49589] - [rt] build kernel-rt-4.18.0-553.16.1.rt7.357.el8_10 [RHEL-44553] - x86/bhi: Fix incorrect CLEAR_BRANCH_HISTORY position in entry_INT80_compat (Waiman Long) [RHEL-50648] - [rt] build kernel-rt-4.18.0-553.15.1.rt7.356.el8_10 [RHEL-44553] - Revert "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-44613] - ionic: fix use after netif_napi_del() (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - ionic: clean interrupt before enabling queue to avoid credit race (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change (CKI Backport Bot) [RHEL-49321] {CVE-2021-47624} - xhci: Handle TD clearing for multiple streams case (CKI Backport Bot) [RHEL-47882] {CVE-2024-40927} - net: openvswitch: Fix Use-After-Free in ovs_ct_exit (cki-backport-bot) [RHEL-36362] {CVE-2024-27395} - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: fix vlan use-after-free (cki-backport-bot) [RHEL-43721] {CVE-2024-36979} - irqchip/gic-v3-its: Prevent double free on error (Charles Mirabile) [RHEL-37022] {CVE-2024-35847} - irqchip/gic-v3-its: Fix potential VPE leak on error (Charles Mirabile) [RHEL-37744] {CVE-2021-47373} - i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() (Charles Mirabile) [RHEL-34735] {CVE-2022-48632} - iommu/dma: fix zeroing of bounce buffer padding used by untrusted devices (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: remove alloc_size argument to swiotlb_tbl_map_single() (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: fix swiotlb_bounce() to do partial sync's correctly (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Reinstate page-alignment for mappings >= PAGE_SIZE (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix alignment checks when both allocation and DMA masks are present (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix double-allocation of slots due to broken alignment handling (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (cki-backport-bot) [RHEL-44441] {CVE-2024-31076} - [rt] build kernel-rt-4.18.0-553.14.1.rt7.355.el8_10 [RHEL-44553] - s390/qeth: Fix kernel panic after setting hsuid (Mete Durlu) [RHEL-49754] - perf/core: Protect event sibling list locking against interrupt inversion (Daniel Vacek) [RHEL-31798] - vt: fix unicode buffer corruption when deleting characters (Steve Best) [RHEL-36936] {CVE-2024-35823} - cifs: translate network errors on send to -ECONNABORTED (Paulo Alcantara) [RHEL-36754] - xfs: don't block in busy flushing when freeing extents (Brian Foster) [RHEL-7984] - xfs: allow extent free intents to be retried (Brian Foster) [RHEL-7984] - xfs: pass alloc flags through to xfs_extent_busy_flush() (Brian Foster) [RHEL-7984] - xfs: use deferred frees for btree block freeing (Brian Foster) [RHEL-7984] - xfs: fix bounds check in xfs_defer_agfl_block() (Brian Foster) [RHEL-7984] - xfs: validate block number being freed before adding to xefi (Brian Foster) [RHEL-7984] - xfs: rename xfs_bmap_add_free to xfs_free_extent_later (Brian Foster) [RHEL-7984] - usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (Desnes Nunes) [RHEL-36803] {CVE-2024-35790} - stm class: Fix a double free in stm_register_device() (Steve Best) [RHEL-44514] {CVE-2024-38627} - s390/qeth: Fix potential loss of L3-IP@ in case of network issues (Mete Durlu) [RHEL-49755] - tls: fix missing memory barrier in tls_init (cki-backport-bot) [RHEL-44471] {CVE-2024-36489} - xfs: fix log recovery buffer allocation for the legacy h_size fixup (Bill O'Donnell) [RHEL-46473] {CVE-2024-39472} - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: use __for_each_thread() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - exit: Use the correct exit_code in /proc/<pid>/stat (Brian Foster) [RHEL-31562] {CVE-2024-26686} - scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool (Ewan D. Milne) [RHEL-38283] {CVE-2023-52811} - scsi: qla2xxx: Fix double free of fcport (Ewan D. Milne) [RHEL-39549] {CVE-2024-26929} - scsi: qla2xxx: Fix double free of the ha->vp_map pointer (Ewan D. Milne) [RHEL-39549] {CVE-2024-26930} - scsi: qla2xxx: Fix command flush on cable pull (Ewan D. Milne) [RHEL-39549] {CVE-2024-26931} - [rt] build kernel-rt-4.18.0-553.13.1.rt7.354.el8_10 [RHEL-44553] - redhat: remove handling of deleted rhdocs/ directory from genspec.sh (Denys Vlasenko) - x86/bugs: Fix BHI retpoline check (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI handling of RRSBA (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr' (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI documentation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix return type of spectre_bhi_state() (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Make CONFIG_SPECTRE_BHI_ON the default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Mitigate KVM by default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add BHI mitigation knob (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Enumerate Branch History Injection (BHI) bug (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Define SPEC_CTRL_BHI_DIS_S (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add support for clearing branch history at syscall entry (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file (Waiman Long) [RHEL-28202] - perf/x86/amd/lbr: Use freeze based on availability (Waiman Long) [RHEL-28202] - Documentation/kernel-parameters: Add spec_rstack_overflow to mitigations=off (Waiman Long) [RHEL-28202] - KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace (Waiman Long) [RHEL-28202] - x86/bugs: Reset speculation control settings on init (Waiman Long) [RHEL-28202] - KVM: x86: Update KVM-only leaf handling to allow for 100% KVM-only leafs (Waiman Long) [RHEL-28202] - KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest (Waiman Long) [RHEL-28202] - mptcp: ensure snd_nxt is properly initialized on connect (Davide Caratti) [RHEL-39865] {CVE-2024-36889} - powerpc/pseries: Enforce hcall result buffer validity and size (Mamatha Inamdar) [RHEL-48291] {CVE-2024-40974} - wifi: mac80211: fix potential key use-after-free (Jose Ignacio Tornos Martinez) [RHEL-28007] {CVE-2023-52530} - cppc_cpufreq: Fix possible null pointer dereference (Mark Langsdorf) [RHEL-44137] {CVE-2024-38573} - net/sched: act_mirred: use the backlog for mirred ingress (Davide Caratti) [RHEL-31718] {CVE-2024-26740} - vfio/pci: Lock external INTx masking ops (Alex Williamson) [RHEL-31922] {CVE-2024-26810} - net: sched: sch_multiq: fix possible OOB write in multiq_tune() (Davide Caratti) [RHEL-43464] {CVE-2024-36978} - tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized (Guillaume Nault) [RHEL-37850] {CVE-2021-47304} - pstore/ram: Fix crash when setting number of cpus to an odd number (Lenny Szubowicz) [RHEL-29471] {CVE-2023-52619} - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node (Jocelyn Falempe) [RHEL-37101] {CVE-2023-52662} - drm/vmwgfx: Fix the lifetime of the bo cursor memory (Jocelyn Falempe) [RHEL-36962] {CVE-2024-35810} - drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed (Jocelyn Falempe) [RHEL-34987] {CVE-2024-26940} - drm/vmwgfx: Unmap the surface before resetting it on a plane state (Jocelyn Falempe) [RHEL-35217] {CVE-2023-52648} - drm/vmwgfx: Fix invalid reads in fence signaled events (Jocelyn Falempe) [RHEL-40010] {CVE-2024-36960} - block: Fix wrong offset in bio_truncate() (Ming Lei) [RHEL-43782] {CVE-2022-48747} - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CKI Backport Bot) [RHEL-46913] {CVE-2024-39487} - net: fix __dst_negative_advice() race (Xin Long) [RHEL-41183] {CVE-2024-36971} - igc: avoid returning frame twice in XDP_REDIRECT (Corinna Vinschen) [RHEL-33264] {CVE-2024-26853} - mac802154: fix llsec key resources release in mac802154_llsec_key_del (Steve Best) [RHEL-34967] {CVE-2024-26961} - cpufreq: exit() callback is optional (Mark Langsdorf) [RHEL-43840] {CVE-2024-38615} - cifs: prevent infinite recursion in CIFSGetDFSRefer() (Paulo Alcantara) [RHEL-34672] - cifs: lock chan_lock outside match_session (Paulo Alcantara) [RHEL-34672] - smb3: workaround negprot bug in some Samba servers (Paulo Alcantara) [RHEL-34672] - smb3: use netname when available on secondary channels (Paulo Alcantara) [RHEL-34672] - smb3: fix empty netname context on secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: populate empty hostnames for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: always iterate smb sessions using primary channel (Paulo Alcantara) [RHEL-34672] - cifs: Fix connections leak when tlink setup failed (Paulo Alcantara) [RHEL-34672] - cifs: Fix memory leak when build ntlmssp negotiate blob failed (Paulo Alcantara) [RHEL-34672] - cifs: always initialize struct msghdr smb_msg completely (Paulo Alcantara) [RHEL-34672] - cifs: don't send down the destination address to sendmsg for a SOCK_STREAM (Paulo Alcantara) [RHEL-34672] - cifs: revalidate mapping when doing direct writes (Paulo Alcantara) [RHEL-34672] - cifs: skip extra NULL byte in filenames (Paulo Alcantara) [RHEL-34672] - cifs: list_for_each() -> list_for_each_entry() (Paulo Alcantara) [RHEL-34672] - smb2: small refactor in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - cifs: Fix crash on unload of cifs_arc4.ko (Paulo Alcantara) [RHEL-34672] - cifs: remove check of list iterator against head past the loop body (Paulo Alcantara) [RHEL-34672] - cifs: fix reconnect on smb3 mount types (Paulo Alcantara) [RHEL-34672] - cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (Paulo Alcantara) [RHEL-34672] - cifs: skip trailing separators of prefix paths (Paulo Alcantara) [RHEL-34672] - cifs: fix ntlmssp on old servers (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL ptr dereference in refresh_mounts() (Paulo Alcantara) [RHEL-34672] - cifs: do not skip link targets when an I/O fails (Paulo Alcantara) [RHEL-34672] - cifs: fix confusing unneeded warning message on smb2.1 and earlier (Paulo Alcantara) [RHEL-34672] - smb3: fix snapshot mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix workstation_name for multiuser mounts (Paulo Alcantara) [RHEL-34672] - cifs: alloc_path_with_tree_prefix: do not append sep. if the path is empty (Paulo Alcantara) [RHEL-34672] - cifs: free ntlmsspblob allocated in negotiate (Paulo Alcantara) [RHEL-34672] - cifs: avoid use of dstaddr as key for fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: add server conn_id to fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: fix missed refcounting of ipc tcon (Paulo Alcantara) [RHEL-34672] - smb2: clarify rc initialization in smb2_reconnect (Paulo Alcantara) [RHEL-34672] - cifs: populate server_hostname for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should be set on new server (Paulo Alcantara) [RHEL-34672] - cifs: introduce cifs_ses_mark_for_reconnect() helper (Paulo Alcantara) [RHEL-34672] - cifs: protect srv_count with cifs_tcp_ses_lock (Paulo Alcantara) [RHEL-34672] - cifs: move debug print out of spinlock (Paulo Alcantara) [RHEL-34672] - cifs: do not duplicate fscache cookie for secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: connect individual channel servers to primary channel server (Paulo Alcantara) [RHEL-34672] - cifs: protect session channel fields with chan_lock (Paulo Alcantara) [RHEL-34672] - cifs: do not negotiate session if session already exists (Paulo Alcantara) [RHEL-34672] - smb3: do not setup the fscache_super_cookie until fsinfo initialized (Paulo Alcantara) [RHEL-34672] - cifs: fix potential use-after-free bugs (Paulo Alcantara) [RHEL-34672] - cifs: release lock earlier in dequeue_mid error case (Paulo Alcantara) [RHEL-34672] - smb3: remove trivial dfs compile warning (Paulo Alcantara) [RHEL-34672] - cifs: support nested dfs links over reconnect (Paulo Alcantara) [RHEL-34672] - cifs: for compound requests, use open handle if possible (Paulo Alcantara) [RHEL-34672] - cifs: split out dfs code from cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant (Paulo Alcantara) [RHEL-34672] - cifs: introduce new helper for cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: fix print of hdr_flags in dfscache_proc_show() (Paulo Alcantara) [RHEL-34672] - cifs: send workstation name during ntlmssp session setup (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should not share socket with future sessions (Paulo Alcantara) [RHEL-34672] - smb3: add dynamic trace points for socket connection (Paulo Alcantara) [RHEL-34672] - cifs: Move SMB2_Create definitions to the shared area (Paulo Alcantara) [RHEL-34672] - cifs: Move more definitions into the shared area (Paulo Alcantara) [RHEL-34672] - cifs: move NEGOTIATE_PROTOCOL definitions out into the common area (Paulo Alcantara) [RHEL-34672] - cifs: Create a new shared file holding smb2 pdu definitions (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect check for null pointer in header_assemble (Paulo Alcantara) [RHEL-34672] - smb3: correct server pointer dereferencing check to be more consistent (Paulo Alcantara) [RHEL-34672] - cifs: Deal with some warnings from W=1 (Paulo Alcantara) [RHEL-34672] - cifs: fix a sign extension bug (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect kernel doc comments (Paulo Alcantara) [RHEL-34672] - cifs: remove pathname for file from SPDX header (Paulo Alcantara) [RHEL-34672] - cifs: move SMB FSCTL definitions to common code (Paulo Alcantara) [RHEL-34672] - cifs: rename cifs_common to smbfs_common (Paulo Alcantara) [RHEL-34672] - cifs: update FSCTL definitions (Paulo Alcantara) [RHEL-34672] - cifs: cifs_md4 convert to SPDX identifier (Paulo Alcantara) [RHEL-34672] - cifs: create a MD4 module and switch cifs.ko to use it (Paulo Alcantara) [RHEL-34672] - cifs: fork arc4 and create a separate module for it for cifs and other users (Paulo Alcantara) [RHEL-34672] - smb3: fix posix extensions mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix wrong release in sess_alloc_buffer() failed path (Paulo Alcantara) [RHEL-34672] - CIFS: Fix a potencially linear read overflow (Paulo Alcantara) [RHEL-34672] - cifs: use the correct max-length for dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: create sd context must be a multiple of 8 (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp sessions of dfs connections (Paulo Alcantara) [RHEL-34672] - cifs: added WARN_ON for all the count decrements (Paulo Alcantara) [RHEL-34672] - cifs: fix missing null session check in mount (Paulo Alcantara) [RHEL-34672] - cifs: handle reconnect of tcon when there is no cached dfs referral (Paulo Alcantara) [RHEL-34672] - cifs: fix the out of range assignment to bit fields in parse_server_interfaces (Paulo Alcantara) [RHEL-34672] - smb3: fix typo in header file (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: Add support for negotiating signing algorithm (Paulo Alcantara) [RHEL-34672] - cifs: prevent NULL deref in cifs_compose_mount_options() (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL dereference in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - smbdirect: missing rc checks while waiting for rdma events (Paulo Alcantara) [RHEL-34672] - cifs: Avoid field over-reading memcpy() (Paulo Alcantara) [RHEL-34672] - smb311: remove dead code for non compounded posix query info (Paulo Alcantara) [RHEL-34672] - cifs: fix SMB1 error path in cifs_get_file_info_unix (Paulo Alcantara) [RHEL-34672] - smb3: fix uninitialized value for port in witness protocol move (Paulo Alcantara) [RHEL-34672] - cifs: fix unneeded null check (Paulo Alcantara) [RHEL-34672] - cifs: use SPDX-Licence-Identifier (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in cifs_debug.c (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in smb2misc.c (Paulo Alcantara) [RHEL-34672] - cifs: missed ref-counting smb session in find (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp servers with dfs mounts (Paulo Alcantara) [RHEL-34672] - cifs: set a minimum of 2 minutes for refreshing dfs cache (Paulo Alcantara) [RHEL-34672] - cifs: Remove unused inline function is_sysvol_or_netlogon() (Paulo Alcantara) [RHEL-34672] - cifs: remove duplicated prototype (Paulo Alcantara) [RHEL-34672] - cifs: fix ipv6 formating in cifs_ses_add_channel (Paulo Alcantara) [RHEL-34672] - cifs: fix string declarations and assignments in tracepoints (Paulo Alcantara) [RHEL-34672] - cifs: fix memory leak in smb2_copychunk_range (Paulo Alcantara) [RHEL-34672] - SMB3: incorrect file id in requests compounded with open (Paulo Alcantara) [RHEL-34672] - smb3: if max_channels set to more than one channel request multichannel (Paulo Alcantara) [RHEL-34672] - smb3: do not attempt multichannel to server which does not support it (Paulo Alcantara) [RHEL-34672] - smb3: when mounting with multichannel include it in requested capabilities (Paulo Alcantara) [RHEL-34672] - cifs: simplify SWN code with dummy funcs instead of ifdefs (Paulo Alcantara) [RHEL-34672] - cifs: log mount errors using cifs_errorf() (Paulo Alcantara) [RHEL-34672] - cifs: switch build_path_from_dentry() to using dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: fix out-of-bound memory access when calling smb3_notify() at mount point (Paulo Alcantara) [RHEL-34672] - cifs: allocate buffer in the caller of build_path_from_dentry() (Paulo Alcantara) [RHEL-34672] - cifs: make build_path_from_dentry() return const char * (Paulo Alcantara) [RHEL-34672] - cifs: remove old dead code (Paulo Alcantara) [RHEL-34672] - fs: cifs: Remove repeated struct declaration (Paulo Alcantara) [RHEL-34672] - cifs: have cifs_fattr_to_inode() refuse to change type on live inode (Paulo Alcantara) [RHEL-34672] - cifs: have ->mkdir() handle race with another client sanely (Paulo Alcantara) [RHEL-34672] - do_cifs_create(): don't set ->i_mode of something we had not created (Paulo Alcantara) [RHEL-34672] - cifs: Silently ignore unknown oplock break handle (Paulo Alcantara) [RHEL-34672] - cifs: change noisy error message to FYI (Paulo Alcantara) [RHEL-34672] - cifs: print MIDs in decimal notation (Paulo Alcantara) [RHEL-34672] - cifs: minor simplification to smb2_is_network_name_deleted (Paulo Alcantara) [RHEL-34672] - TCON Reconnect during STATUS_NETWORK_NAME_DELETED (Paulo Alcantara) [RHEL-34672] - cifs: clarify hostname vs ip address in /proc/fs/cifs/DebugData (Paulo Alcantara) [RHEL-34672] - cifs: change confusing field serverName (to ip_addr) (Paulo Alcantara) [RHEL-34672] - cifs: Reformat DebugData and index connections by conn_id. (Paulo Alcantara) [RHEL-34672] - cifs: Identify a connection by a conn_id. (Paulo Alcantara) [RHEL-34672] - smb3: negotiate current dialect (SMB3.1.1) when version 3 or greater requested (Paulo Alcantara) [RHEL-34672] - smb3: Fix out-of-bounds bug in SMB2_negotiate() (Paulo Alcantara) [RHEL-34672] - fs/cifs: Simplify bool comparison. (Paulo Alcantara) [RHEL-34672] - fs/cifs: Assign boolean values to a bool variable (Paulo Alcantara) [RHEL-34672] - cifs: Avoid error pointer dereference (Paulo Alcantara) [RHEL-34672] - cifs: Re-indent cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Unlock on errors in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Delete a stray unlock in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Tracepoints and logs for tracing credit changes. (Paulo Alcantara) [RHEL-34672] - cifs: Fix some error pointers handling detected by static checker (Paulo Alcantara) [RHEL-34672] - smb3: remind users that witness protocol is experimental (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: do not log warning message if server doesn't populate salt (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: update comments clarifying SPNEGO info in negprot response (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot rsp (Paulo Alcantara) [RHEL-34672] - SMB3: avoid confusing warning message on mount to Azure (Paulo Alcantara) [RHEL-34672] - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (Nigel Croxon) [RHEL-46662] {CVE-2024-39476} - net: fix information leakage in /proc/net/ptype (Hangbin Liu) [RHEL-44000] {CVE-2022-48757} - usb: typec: ucsi: Limit read size on v1.2 (Desnes Nunes) [RHEL-37286] {CVE-2024-35924} - minmax: relax check to allow comparison between unsigned arguments and signed constants (Desnes Nunes) [RHEL-37286] - minmax: allow comparisons of 'int' against 'unsigned char/short' (Desnes Nunes) [RHEL-37286] - minmax: allow min()/max()/clamp() if the arguments have the same signedness. (Desnes Nunes) [RHEL-37286] - minmax: add umin(a, b) and umax(a, b) (Desnes Nunes) [RHEL-37286] - minmax: fix header inclusions (Desnes Nunes) [RHEL-37286] - minmax: clamp more efficiently by avoiding extra comparison (Desnes Nunes) [RHEL-37286] - minmax: sanity check constant bounds when clamping (Desnes Nunes) [RHEL-37286] - tracing: Define the is_signed_type() macro once (Desnes Nunes) [RHEL-37286] - linux/bits.h: fix compilation error with GENMASK (Desnes Nunes) [RHEL-37286] - x86/apic: Mask IOAPIC entries when disabling the local APIC (Lenny Szubowicz) [RHEL-18077] - userfaultfd: fix a race between writeprotect and exit_mmap() (Rafael Aquini) [RHEL-38410] {CVE-2021-47461} - mm: khugepaged: skip huge page collapse for special files (Waiman Long) [RHEL-38446] {CVE-2021-47491} - cachefiles: fix memory leak in cachefiles_add_cache() (Andrey Albershteyn) [RHEL-33109] {CVE-2024-26840} - drm/amd/display: Implement bounds check for stream encoder creation in DCN301 (Michel Dänzer) [RHEL-31429] {CVE-2024-26660} - net/mlx5: Discard command completions in internal error (Kamal Heib) [RHEL-44231] {CVE-2024-38555} - drm: Don't unref the same fb many times by mistake due to deadlock handling (CKI Backport Bot) [RHEL-29011] {CVE-2023-52486} - md: fix resync softlockup when bitmap size is less than array size (Nigel Croxon) [RHEL-43942] {CVE-2024-38598} - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation (Davide Caratti) [RHEL-39712] {CVE-2024-36017} - netfilter: nf_tables: discard table flag update with pending basechain deletion (Phil Sutter) [RHEL-37205] {CVE-2024-35897} - netfilter: nf_tables: reject table flag and netdev basechain updates (Phil Sutter) [RHEL-37205] - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (Ewan D. Milne) [RHEL-40172] {CVE-2024-36924} - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (Ewan D. Milne) [RHEL-40172] {CVE-2024-36952} - netfilter: nf_tables: fix memleak in map from abort path (Phil Sutter) [RHEL-35052] {CVE-2024-27011} - netfilter: nf_tables: reject new basechain after table flag update (Phil Sutter) [RHEL-37193] {CVE-2024-35900} - netfilter: nf_tables: flush pending destroy work before exit_net release (Phil Sutter) [RHEL-37197] {CVE-2024-35899} - netfilter: complete validation of user input (Phil Sutter) [RHEL-37210] - netfilter: validate user input for expected length (Phil Sutter) [RHEL-37210] {CVE-2024-35896} - netfilter: tproxy: bail out if IP has been disabled on the device (Phil Sutter) [RHEL-44363] {CVE-2024-36270} - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (Phil Sutter) [RHEL-44532] {CVE-2024-36286} - netfilter: nf_tables: do not compare internal table flags on updates (Phil Sutter) [RHEL-35114] {CVE-2024-27065} - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (Phil Sutter) [RHEL-35028] {CVE-2024-27019} - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (Phil Sutter) [RHEL-35024] {CVE-2024-27020} - netfilter: nf_tables: __nft_expr_type_get() selects specific family type (Phil Sutter) [RHEL-35024] - netfilter: conntrack: serialize hash resizes and cleanups (Phil Sutter) [RHEL-37703] {CVE-2021-47408} - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (Phil Sutter) [RHEL-34217] {CVE-2024-26925} - netfilter: nf_tables: release batch on table validation from abort path (Phil Sutter) [RHEL-34217] - ipvlan: add ipvlan_route_v6_outbound() helper (Davide Caratti) [RHEL-38319] {CVE-2023-52796} - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.23.1.rt7.364.el8_10 [RHEL-59541] - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002] - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924} - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042} - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070} - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898} - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301} - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976} - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540} - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284} - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857} - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924} - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983} - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854} - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936} - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093} - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961} - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880} - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244} - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984} - [rt] build kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 [RHEL-53529] - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071} - [rt] build kernel-rt-4.18.0-553.21.1.rt7.362.el8_10 [RHEL-53529] - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874] - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558} - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441} - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904} - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322} - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246} - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008} - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228} - [rt] build kernel-rt-4.18.0-553.20.1.rt7.361.el8_10 [RHEL-53529] - KVM: arm64: Disassociate vcpus from redistributor region on teardown (Shaoqin Huang) [RHEL-48417] {CVE-2024-40989} - devres: Fix memory leakage caused by driver API devm_free_percpu() (CKI Backport Bot) [RHEL-55597] {CVE-2024-43871} - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (Izabela Bakollari) [RHEL-26680] {CVE-2024-26600} - nvmet-fc: avoid deadlock on delete association path (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - nvmet-fc: release reference on target port (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - ACPI: LPIT: Avoid u32 multiplication overflow (Mark Langsdorf) [RHEL-37062] {CVE-2023-52683} - sched/deadline: Fix task_struct reference leak (Phil Auld) [RHEL-50904] {CVE-2024-41023} - nfsd: fix crash on LOCKT on reexported NFSv3 (Benjamin Coddington) [RHEL-31515] - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path (CKI Backport Bot) [RHEL-26570] {CVE-2024-26595} - mlxsw: spectrum_acl_tcam: Move devlink param to TCAM code (Ivan Vecera) [RHEL-26570] {CVE-2024-26595} - ACPI: extlog: fix NULL pointer dereference check (Mark Langsdorf) [RHEL-29110] {CVE-2023-52605} - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() (Mark Langsdorf) [RHEL-33198] {CVE-2024-26894} - mm: prevent derefencing NULL ptr in pfn_section_valid() (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - mm, kmsan: fix infinite recursion due to RCU critical section (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - cipso: make cipso_v4_skbuff_delattr() fully remove the CIPSO options (Ondrej Mosnacek) [RHEL-30904] - cipso: fix total option length computation (Ondrej Mosnacek) [RHEL-30904] - ext4: do not create EA inode under buffer lock (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: check the return value of ext4_xattr_inode_dec_ref() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (Carlos Maiolino) [RHEL-48507] {CVE-2024-40998} - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - [rt] build kernel-rt-4.18.0-553.19.1.rt7.360.el8_10 [RHEL-53529] - drm/i915/vma: Fix UAF on destroy against retire race (Mika Penttilä) [RHEL-35222] {CVE-2024-26939} - RHEL-48620 (Kenneth Yin) [RHEL-48620] - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (CKI Backport Bot) [RHEL-42721] {CVE-2024-26855} - net: usb: asix: do not force pause frames support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix "can't send until first packet is send" issue (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix modprobe "sysfs: cannot create duplicate filename" (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: add proper error handling of usb read errors (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix wrong return value in asix_check_host_enable() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix uninit-value in asix_mdio_read() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: fix boolconv.cocci warnings (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: do not call phy_disconnect() for ax88178 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: move embedded PHY detection as early as possible (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix uninit value bugs (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add missing stop (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: suspend PHY on driver probe (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: manage PHY PM from MAC (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: add error handling for asix_mdio_* functions (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add phylib support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: refactor asix_read_phy_addr() and handle errors on return (Ken Cox) [RHEL-28108] {CVE-2021-47101} - SUNRPC: always free ctxt when freeing deferred request (Jay Shin) [RHEL-40936] - SUNRPC: double free xprt_ctxt while still in use (Jay Shin) [RHEL-40936] - SUNRPC: Remove svc_rqst::rq_xprt_hlen (Jay Shin) [RHEL-40936] - SUNRPC: Remove dead code in svc_tcp_release_rqst() (Jay Shin) [RHEL-40936] - x86/bugs: Extend VMware Retbleed workaround to Nehalem & earlier CPUs (Waiman Long) [RHEL-48646] - wifi: iwlwifi: read txq->read_ptr under lock (Jose Ignacio Tornos Martinez) [RHEL-39797] {CVE-2024-36922} - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (John Meneghini) [RHEL-39908] {CVE-2024-36919} - nbd: always initialize struct msghdr completely (Ming Lei) [RHEL-29498] {CVE-2024-26638} - block: don't call rq_qos_ops->done_bio if the bio isn't tracked (Ming Lei) [RHEL-42151] {CVE-2021-47412} - nvmet: fix a possible leak when destroy a ctrl during qp establishment (Maurizio Lombardi) [RHEL-52013] {CVE-2024-42152} - ipv6: prevent NULL dereference in ip6_output() (Sabrina Dubroca) [RHEL-39912] {CVE-2024-36901} - ppp: reject claimed-as-LCP but actually malformed packets (Guillaume Nault) [RHEL-51052] {CVE-2024-41044} - leds: trigger: Unregister sysfs attributes before calling deactivate() (CKI Backport Bot) [RHEL-54834] {CVE-2024-43830} - crypto: bcm - Fix pointer arithmetic (cki-backport-bot) [RHEL-44108] {CVE-2024-38579} - scsi: qedf: Ensure the copied buf is NUL terminated (John Meneghini) [RHEL-44195] {CVE-2024-38559} - x86/bhi: Avoid warning in #DB handler due to BHI mitigation (Waiman Long) [RHEL-53657] {CVE-2024-42240} - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (CKI Backport Bot) [RHEL-47529] {CVE-2024-40901} - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (CKI Backport Bot) [RHEL-39843] {CVE-2024-36902} - net: usb: ax88179_178a: improve link status logs (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: improve reset check (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: fix link status when link is set to down/up (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: avoid writing the mac address before first reading (Jose Ignacio Tornos Martinez) [RHEL-45167] - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - media: cec: cec-api: add locking in cec_release() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid confusing "transmit timed out" message (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid recursive cec_claim_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: remove length check of Timer Status (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: count low-drive, error and arb-lost conditions (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add note about *_from_edid() function usage in drm (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_unconfigured() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_nb_transmit_canceled() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: don't set last_initiator if tx in progress (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: disable adapter in cec_devnode_unregister (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: not all messages were passed on when monitoring (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add support for Absolute Volume Control (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: log when claiming LA fails unexpectedly (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: drop activate_cnt, use state info instead (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: reconfigure if the PA changes during configuration (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: fix is_configuring state (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: stop trying LAs on CEC_TX_STATUS_TIMEOUT (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't unconfigure if already unconfigured (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add optional adap_configured callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add xfer_timeout_ms field (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: use call_op and check for !unregistered (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix interrupt en/disable handling (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: drop unused 'enabled' field from struct cec_pin (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix off-by-one SFT check (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: rename timer overrun variables (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: correctly pass on reply results (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: abort if the current transmit was canceled (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: call enable_adap on s_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: media/cec.h: document cec_adapter fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix a deadlock situation (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: safely unhook lists in cec_data (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: copy sequence field for the reply (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix trivial style warnings (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: add 'unregistered' checks (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't use flush_scheduled_work() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: Use fallthrough pseudo-keyword (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: remove unused waitq and phys_addrs fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: silence shift wrapping warning in __cec_s_log_addrs() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: move the core to a separate directory (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - net/iucv: Avoid explicit cpumask var allocation on stack (CKI Backport Bot) [RHEL-51631] {CVE-2024-42094} - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (Dick Kennedy) [RHEL-40400] - KVM: selftests: Make hyperv_clock require TSC based system clocksource (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Run clocksource dependent tests with hyperv_clocksource_tsc_page too (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Use generic sys_clocksource_is_tsc() in vmx_nested_tsc_scaling_test (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Generalize check_clocksource() from kvm_clock_test (Vitaly Kuznetsov) [RHEL-19027] - firmware: cs_dsp: Return error if block header overflows file (CKI Backport Bot) [RHEL-53646] {CVE-2024-42238} - firmware: cs_dsp: Validate payload length before processing block (CKI Backport Bot) [RHEL-53638] {CVE-2024-42237} - mm, slub: fix potential memoryleak in kmem_cache_open() (Waiman Long) [RHEL-38404] {CVE-2021-47466} - slub: don't panic for memcg kmem cache creation failure (Waiman Long) [RHEL-38404] {CVE-2021-47466} - wifi: ath11k: fix htt pktlog locking (Jose Ignacio Tornos Martinez) [RHEL-38317] {CVE-2023-52800} - wifi: ath11k: fix dfs radar event locking (Jose Ignacio Tornos Martinez) [RHEL-38165] {CVE-2023-52798} - lib/generic-radix-tree.c: Don't overflow in peek() (Waiman Long) [RHEL-37737] {CVE-2021-47432} - include/linux/generic-radix-tree.h: replace kernel.h with the necessary inclusions (Waiman Long) [RHEL-37737] {CVE-2021-47432} - EDAC/i10nm: Skip the absent memory controllers (Aristeu Rozanski) [RHEL-43236] - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (John Meneghini) [RHEL-38197] {CVE-2023-52809} - gfs2: Fix potential glock use-after-free on unmount (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: simplify gdlm_put_lock with out_free label (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: Remove ill-placed consistency check (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - nvme-fc: do not wait in vain when unloading module (Ewan D. Milne) [RHEL-33083] {CVE-2024-26846} - HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts (CKI Backport Bot) [RHEL-49698] {CVE-2022-48866} - scsi: qedf: Set qed_slowpath_params to zero before use (John Meneghini) [RHEL-9797] - scsi: qedf: Wait for stag work during unload (John Meneghini) [RHEL-9797] - scsi: qedf: Don't process stag work during unload and recovery (John Meneghini) [RHEL-9797] - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - mm: avoid overflows in dirty throttling logic (Audra Mitchell) [RHEL-51840] {CVE-2024-42131} - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - ACPI: fix NULL pointer dereference (Mark Langsdorf) [RHEL-37897] {CVE-2021-47289} - [rt] build kernel-rt-4.18.0-553.18.1.rt7.359.el8_10 [RHEL-53529] - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING (Ewan D. Milne) [RHEL-39805] {CVE-2024-36920} - tun: limit printing rate when illegal packet received by tun dev (Jon Maloy) [RHEL-35046] {CVE-2024-27013} - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu/mes: fix use-after-free issue (Michel Dänzer) [RHEL-44043] {CVE-2024-38581} - drm/amdgpu: Fix the null pointer when load rlc firmware (Michel Dänzer) [RHEL-30603] {CVE-2024-26649} - drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (Michel Dänzer) [RHEL-35160] {CVE-2024-27042} - net/sched: Fix UAF when resolving a clash (Xin Long) [RHEL-51014] {CVE-2024-41040} - tcp_metrics: validate source addr length (Guillaume Nault) [RHEL-52025] {CVE-2024-42154} - NFSv4/pnfs: Fix a use-after-free bug in open (Benjamin Coddington) [RHEL-35508] - NFSv4: Don't hold the layoutget locks across multiple RPC calls (Benjamin Coddington) [RHEL-35508] - scsi: qedf: Make qedf_execute_tmf() non-preemptible (John Meneghini) [RHEL-51799] {CVE-2024-42124} - Input: elantech - fix stack out of bound access in elantech_change_report_id() (CKI Backport Bot) [RHEL-41938] {CVE-2021-47097} - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (CKI Backport Bot) [RHEL-28982] {CVE-2023-52478} - drm/radeon: fix UBSAN warning in kv_dpm.c (CKI Backport Bot) [RHEL-48399] {CVE-2024-40988} - usb: core: Don't hold the device lock while sleeping in do_proc_control() (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - USB: core: Make do_proc_control() and do_proc_bulk() killable (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - scsi: qedi: Fix crash while reading debugfs attribute (CKI Backport Bot) [RHEL-48327] {CVE-2024-40978} - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CKI Backport Bot) [RHEL-48309] {CVE-2024-40977} - net: tcp: accept old ack during closing (Jamie Bainbridge) [RHEL-52433] - wifi: iwlwifi: mvm: don't read past the mfuart notifcation (CKI Backport Bot) [RHEL-48016] {CVE-2024-40941} - net/iucv: fix use after free in iucv_sock_close() (Mete Durlu) [RHEL-53988] - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (CKI Backport Bot) [RHEL-47908] {CVE-2024-40929} - Input: aiptek - properly check endpoint type (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - use descriptors of current altsetting (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - fix endpoint sanity check (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB (CKI Backport Bot) [RHEL-52373] {CVE-2024-42226} - wifi: mt76: replace skb_put with skb_put_zero (CKI Backport Bot) [RHEL-52366] {CVE-2024-42225} - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (CKI Backport Bot) [RHEL-47776] {CVE-2024-40912} - wifi: cfg80211: Lock wiphy in cfg80211_get_station (CKI Backport Bot) [RHEL-47758] {CVE-2024-40911} - VMCI: Use struct_size() in kmalloc() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() (Steve Best) [RHEL-37325] {CVE-2024-35944} - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values (Jose Ignacio Tornos Martinez) [RHEL-51761] {CVE-2024-42114} - usb: atm: cxacru: fix endpoint checking in cxacru_bind() (CKI Backport Bot) [RHEL-51442] {CVE-2024-41097} - nfs: handle error of rpc_proc_register() in init_nfs_fs() (Scott Mayhew) [RHEL-39904] {CVE-2024-36939} - drm/radeon: check bo_va->bo is non-NULL before using it (CKI Backport Bot) [RHEL-51184] {CVE-2024-41060} - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). (CKI Backport Bot) [RHEL-51027] {CVE-2024-41041} - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (CKI Backport Bot) [RHEL-50961] {CVE-2024-41035} - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). (CKI Backport Bot) [RHEL-44408] {CVE-2024-37356} - tcp: avoid too many retransmit packets (Florian Westphal) [RHEL-48627] {CVE-2024-41007} - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() (Florian Westphal) [RHEL-48627] - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Florian Westphal) [RHEL-48627] - tcp: refactor tcp_retransmit_timer() (Florian Westphal) [RHEL-48627] - tcp: exit if nothing to retransmit on RTO timeout (Florian Westphal) [RHEL-48627] - netfilter: nf_tables: Reject tables of unsupported family (Florian Westphal) [RHEL-21418] {CVE-2023-6040} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.23.1.rt7.364.el8_10 [RHEL-59541] - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002] - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924} - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042} - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070} - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898} - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301} - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976} - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540} - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284} - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857} - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924} - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983} - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854} - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936} - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093} - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961} - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880} - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244} - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984} - [rt] build kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 [RHEL-53529] - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071} - [rt] build kernel-rt-4.18.0-553.21.1.rt7.362.el8_10 [RHEL-53529] - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874] - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558} - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441} - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904} - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322} - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246} - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008} - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228} - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.23.1.rt7.364.el8_10 [RHEL-59541] - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002] - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924} - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042} - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070} - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898} - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301} - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976} - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540} - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284} - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857} - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924} - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983} - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854} - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936} - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093} - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961} - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880} - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244} - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - [rt] build kernel-rt-4.18.0-553.35.1.rt7.376.el8_10 [RHEL-72569] - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480] - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480] - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396] - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - [rt] build kernel-rt-4.18.0-553.35.1.rt7.376.el8_10 [RHEL-72569] - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480] - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480] - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396] - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - [rt] build kernel-rt-4.18.0-553.35.1.rt7.376.el8_10 [RHEL-72569] - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480] - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480] - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396] - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.5.1.rt7.346.el8_10 [RHEL-34640] - tools/power/turbostat: Fix uncore frequency file string (David Arcari) [RHEL-29238] - tools/power turbostat: Expand probe_intel_uncore_frequency() (David Arcari) [RHEL-29238] - uio: Fix use-after-free in uio_open (Ricardo Robaina) [RHEL-26232] {CVE-2023-52439} - net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (Ken Cox) [RHEL-27316] {CVE-2021-47013} - keys: Fix linking a duplicate key to a keyring's assoc_array (David Howells) [RHEL-30772] - keys: Hoist locking out of __key_link_begin() (David Howells) [RHEL-30772] - keys: Break bits out of key_unlink() (David Howells) [RHEL-30772] - keys: Change keyring_serialise_link_sem to a mutex (David Howells) [RHEL-30772] - wifi: brcm80211: handle pmk_op allocation failure (Jose Ignacio Tornos Martinez) [RHEL-35150] {CVE-2024-27048} - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work (Jose Ignacio Tornos Martinez) [RHEL-35140] {CVE-2024-27052} - wifi: iwlwifi: mvm: ensure offloading TID queue exists (Jose Ignacio Tornos Martinez) [RHEL-35130] {CVE-2024-27056} - wifi: mt76: mt7921e: fix use-after-free in free_irq() (Jose Ignacio Tornos Martinez) [RHEL-34866] {CVE-2024-26892} - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete (Jose Ignacio Tornos Martinez) [RHEL-34189] {CVE-2024-26897} - wifi: iwlwifi: mvm: fix a crash when we run out of stations (Jose Ignacio Tornos Martinez) [RHEL-31547] {CVE-2024-26693} - wifi: iwlwifi: fix double-free bug (Jose Ignacio Tornos Martinez) [RHEL-31543] {CVE-2024-26694} - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (Jose Ignacio Tornos Martinez) [RHEL-29089] {CVE-2023-52594} - wifi: rt2x00: restart beacon queue when hardware reset (Jose Ignacio Tornos Martinez) [RHEL-29093] {CVE-2023-52595} - wifi: iwlwifi: fix a memory corruption (Jose Ignacio Tornos Martinez) [RHEL-28903] {CVE-2024-26610} - [rt] build kernel-rt-4.18.0-553.4.1.rt7.345.el8_10 [RHEL-34640] - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117] - net/mlx5e: Prevent deadlock while disabling aRFS (Kamal Heib) [RHEL-35041] {CVE-2024-27014} - x86/tsc: Defer marking TSC unstable to a worker (Wander Lairson Costa) [RHEL-32676] - x86/smpboot: Make TSC synchronization function call based (Wander Lairson Costa) [RHEL-32676] - net: usb: fix possible use-after-free in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - net: usb: fix memory leak in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - [rt] build kernel-rt-4.18.0-552.3.1.rt7.344.el8_10 [RHEL-34640] - netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (Phil Sutter) [RHEL-30076] {CVE-2024-26643} - netfilter: nf_tables: disallow anonymous set with timeout flag (Phil Sutter) [RHEL-30080] {CVE-2024-26642} - selftests/bpf: Fix pyperf180 compilation failure with clang18 (Artem Savkov) [RHEL-35576] - md/raid5: fix atomicity violation in raid5_cache_count (Nigel Croxon) [RHEL-27930] {CVE-2024-23307} - usb: ulpi: Fix debugfs directory leak (Desnes Nunes) [RHEL-33287] {CVE-2024-26919} - powerpc/pseries: Fix potential memleak in papr_get_attr() (Mamatha Inamdar) [RHEL-35213] {CVE-2022-48669} - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (Desnes Nunes) [RHEL-35122] {CVE-2024-27059} - NFSv4: fairly test all delegations on a SEQ4_ revocation (Benjamin Coddington) [RHEL-34912] - USB: core: Fix deadlock in usb_deauthorize_interface() (Desnes Nunes) [RHEL-35002] {CVE-2024-26934} - usb: xhci: Add error handling in xhci_map_urb_for_dma (Desnes Nunes) [RHEL-34958] {CVE-2024-26964} - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (Ewan D. Milne) [RHEL-35076] {CVE-2024-26993} - xhci: handle isoc Babble and Buffer Overrun events properly (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - xhci: process isoc TD properly when there was a transaction error mid TD. (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - USB: core: Fix deadlock in port "disable" sysfs attribute (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - USB: core: Add hub_get() and hub_put() routines (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - netfilter: ipset: Missing gc cancellations fixed (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix performance regression in swap operation (Phil Sutter) [RHEL-30521] - netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test (Phil Sutter) [RHEL-30521] - x86/apic/x2apic: Fix a NULL pointer deref when handling a dying cpu (David Arcari) [RHEL-32516] - x86/coco: Disable 32-bit emulation by default on TDX and SEV (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Make IA32_EMULATION boot time configurable (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/elf: Make loading of 32bit processes depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Rename ignore_sysret() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/cpu: Don't write CSTAR MSR on Intel CPUs (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Introduce ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - [rt] build kernel-rt-4.18.0-552.2.1.rt7.343.el8_10 [RHEL-34640] - s390/ptrace: handle setting of fpc register correctly (Tobias Huschle) [RHEL-29106] {CVE-2023-52598} - net/smc: fix illegal rmb_desc access in SMC-D connection dump (Tobias Huschle) [RHEL-27746] {CVE-2024-26615} - wifi: mac80211: fix race condition on enabling fast-xmit (Jose Ignacio Tornos Martinez) [RHEL-31664] {CVE-2024-26779} - powerpc/fadump: make is_kdump_kernel() return false when fadump is active (Mamatha Inamdar) [RHEL-24401] - vmcore: remove dependency with is_kdump_kernel() for exporting vmcore (Mamatha Inamdar) [RHEL-24401] - mtd: require write permissions for locking and badblock ioctls (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - mtd: properly check all write ioctls for permissions (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - pid: take a reference when initializing `cad_pid` (Waiman Long) [RHEL-29420] {CVE-2021-47118} - i2c: i801: Don't generate an interrupt on bus reset (Prarit Bhargava) [RHEL-30325] {CVE-2021-47153} - RDMA/srpt: Do not register event handler until srpt device is fully setup (Kamal Heib) [RHEL-33224] {CVE-2024-26872} - ceph: switch to corrected encoding of max_xattr_size in mdsmap (Xiubo Li) [RHEL-26723] - ceph: switch to use cap_delay_lock for the unlink delay list (Xiubo Li) [RHEL-32870] - ceph: pass ino# instead of old_dentry if it's disconnected (Xiubo Li) [RHEL-32870] - fat: fix uninitialized field in nostale filehandles (Andrey Albershteyn) [RHEL-33186 RHEL-35108] {CVE-2024-26973} - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (Andrey Albershteyn) [RHEL-33186] {CVE-2024-26901} - idpf: limit the support to GCP only (Michal Schmidt) [RHEL-15652] - redhat/configs: enable CONFIG_IDPF (Michal Schmidt) [RHEL-15652] - idpf: remove the use of ETHTOOL_RING_USE_TCP_DATA_SPLIT (Michal Schmidt) [RHEL-15652] - idpf: workaround for unavailable skb page recycling (Michal Schmidt) [RHEL-15652] - idpf: always allocate a full page (Michal Schmidt) [RHEL-15652] - idpf: remove page pool stats code (Michal Schmidt) [RHEL-15652] - idpf: add minimal macros for __free(kfree) to work (Michal Schmidt) [RHEL-15652] - idpf: fixup include paths for RHEL 8 (Michal Schmidt) [RHEL-15652] - idpf: fix kernel panic on unknown packet types (Michal Schmidt) [RHEL-15652] - idpf: disable local BH when scheduling napi for marker packets (Michal Schmidt) [RHEL-15652] - idpf: remove dealloc vector msg err in idpf_intr_rel (Michal Schmidt) [RHEL-15652] - idpf: fix minor controlq issues (Michal Schmidt) [RHEL-15652] - idpf: prevent deinit uninitialized virtchnl core (Michal Schmidt) [RHEL-15652] - idpf: cleanup virtchnl cruft (Michal Schmidt) [RHEL-15652] - idpf: refactor idpf_recv_mb_msg (Michal Schmidt) [RHEL-15652] - idpf: add async_handler for MAC filter messages (Michal Schmidt) [RHEL-15652] - idpf: refactor remaining virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor queue related virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor vport virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: implement virtchnl transaction manager (Michal Schmidt) [RHEL-15652] - idpf: add idpf_virtchnl.h (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler padding in virtchnl2_ptype struct (Michal Schmidt) [RHEL-15652] - idpf: distinguish vports by the dev_port attribute (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler introduced padding in virtchnl2_rss_key struct (Michal Schmidt) [RHEL-15652] - idpf: fix corrupted frames and skb leaks in singleq mode (Michal Schmidt) [RHEL-15652] - idpf: refactor some missing field get/prep conversions (Michal Schmidt) [RHEL-15652] - idpf: add get/set for Ethtool's header split ringparam (Michal Schmidt) [RHEL-15652] - idpf: fix potential use-after-free in idpf_tso() (Michal Schmidt) [RHEL-15652] - idpf: cancel mailbox work in error path (Michal Schmidt) [RHEL-15652] - idpf: set scheduling mode for completion queue (Michal Schmidt) [RHEL-15652] - idpf: add SRIOV support and other ndo_ops (Michal Schmidt) [RHEL-15652] - idpf: add ethtool callbacks (Michal Schmidt) [RHEL-15652] - idpf: add singleq start_xmit and napi poll (Michal Schmidt) [RHEL-15652] - idpf: add RX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add TX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add splitq start_xmit (Michal Schmidt) [RHEL-15652] - idpf: initialize interrupts and enable vport (Michal Schmidt) [RHEL-15652] - idpf: configure resources for RX queues (Michal Schmidt) [RHEL-15652] - idpf: configure resources for TX queues (Michal Schmidt) [RHEL-15652] - idpf: add ptypes and MAC filter support (Michal Schmidt) [RHEL-15652] - idpf: add create vport and netdev configuration (Michal Schmidt) [RHEL-15652] - idpf: add core init and interrupt request (Michal Schmidt) [RHEL-15652] - idpf: add controlq init and reset checks (Michal Schmidt) [RHEL-15652] - idpf: add module register and probe functionality (Michal Schmidt) [RHEL-15652] - virtchnl: add virtchnl version 2 ops (Michal Schmidt) [RHEL-15652] - net: netdev_queue: netdev_txq_completed_mb(): fix wake condition (Michal Schmidt) [RHEL-15652] - net: piggy back on the memory barrier in bql when waking queues (Michal Schmidt) [RHEL-15652] - net: provide macros for commonly copied lockless queue stop/wake code (Michal Schmidt) [RHEL-15652] - [rt] build kernel-rt-4.18.0-552.1.1.rt7.342.el8_10 [RHEL-34640] - build: Update RTBZ for 8.10 z-stream builds (Denys Vlasenko) - redhat: set DIST to el8_10 and ZSTREAM to yes for 8.10 (Denys Vlasenko) - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (Prarit Bhargava) [RHEL-32590] {CVE-2021-47185} - net: mana: Fix Rx DMA datasize and skb_over_panic (Cathy Avery) [RHEL-32579] - RDMA/srpt: Support specifying the srpt_service_guid parameter (Kamal Heib) [RHEL-31710] {CVE-2024-26744} - RDMA/qedr: Fix qedr_create_user_qp error flow (Kamal Heib) [RHEL-31714] {CVE-2024-26743} - hwmon: (coretemp) Fix out-of-bounds memory access (David Arcari) [RHEL-31305] {CVE-2024-26664} - RDMA/irdma: Fix KASAN issue with tasklet (Kamal Heib) [RHEL-15776] - net: bridge: use DEV_STATS_INC() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: Fix unwanted sign extension in netdev_stats_to_stats64() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: add atomic_long_t to net_device_stats fields (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net/sched: act_ct: fix skb leak and crash on ooo frags (Xin Long) [RHEL-29467] {CVE-2023-52610} - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Jose Ignacio Tornos Martinez) [RHEL-28015] {CVE-2023-52528} - RDMA/core: Fix uninit-value access in ib_get_eth_speed() (Kamal Heib) [RHEL-30130] - RDMA/core: Get IB width and speed from netdev (Kamal Heib) [RHEL-30130] - cpufreq: intel_pstate: Add Emerald Rapids support in no-HWP mode (Prarit Bhargava) [RHEL-29444] - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add (Mamatha Inamdar) [RHEL-29118] {CVE-2023-52607} - powerpc/lib: Validate size for vector operations (Mamatha Inamdar) [RHEL-29114] {CVE-2023-52606} - usb: hub: Guard against accesses to uninitialized BOS descriptors (Desnes Nunes) [RHEL-28986] {CVE-2023-52477} - media: uvcvideo: Fix OOB read (Desnes Nunes) [RHEL-27940] {CVE-2023-52565} - media: pvrusb2: fix use after free on context disconnection (Desnes Nunes) [RHEL-26498] {CVE-2023-52445} - i2c: i801: Fix block process call transactions (Prarit Bhargava) [RHEL-26478] {CVE-2024-26593} - overlay: disable EVM (Coiby Xu) [RHEL-19863] - evm: add support to disable EVM on unsupported filesystems (Coiby Xu) [RHEL-19863] - evm: don't copy up 'security.evm' xattr (Coiby Xu) [RHEL-19863] - net: ena: Remove ena_select_queue (Kamal Heib) [RHEL-14286] - media: dvbdev: Fix memory leak in dvb_media_device_free() (Prarit Bhargava) [RHEL-27254] {CVE-2020-36777} - gfs2: Fix invalid metadata access in punch_hole (Andrew Price) [RHEL-28784] - i2c: Fix a potential use after free (Prarit Bhargava) [RHEL-26849] {CVE-2019-25162} - i2c: validate user data in compat ioctl (Prarit Bhargava) [RHEL-27022] {CVE-2021-46934} - platform/x86: think-lmi: Fix reference leak (Prarit Bhargava) [RHEL-28030] {CVE-2023-52520} - vhost: use kzalloc() instead of kmalloc() followed by memset() (Jon Maloy) [RHEL-21505] {CVE-2024-0340} - RDMA/siw: Fix connection failure handling (Kamal Heib) [RHEL-28042] {CVE-2023-52513} - vt: fix memory overlapping when deleting chars in the buffer (Waiman Long) [RHEL-27778 RHEL-27779] {CVE-2022-48627} - x86/fpu: Stop relying on userspace for info to fault in xsave buffer (Steve Best) [RHEL-26669] {CVE-2024-26603} - mptcp: fix double-free on socket dismantle (Davide Caratti) [RHEL-22773] {CVE-2024-26782} - crypto: akcipher - Disable signing and decryption (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: akcipher - default implementations for request callbacks (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: testmgr - split akcipher tests by a key type (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - workqueue: Warn when a rescuer could not be created (Waiman Long) [RHEL-22136] - RDMA/cma: Avoid GID lookups on iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/cma: Deduplicate error flow in cma_validate_port() (Benjamin Coddington) [RHEL-12456] - RDMA/core: Set gid_attr.ndev for iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/siw: Fabricate a GID on tun and loopback devices (Benjamin Coddington) [RHEL-12456] - eventpoll: fix missing wakeup for ovflist in ep_poll_callback (Luis Claudio R. Goncalves) [RHEL-23022] - [rt] build kernel-rt-4.18.0-552.rt7.341.el8 [RHEL-5332] - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248] - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248] - [rt] build kernel-rt-4.18.0-551.rt7.340.el8 [RHEL-5332] - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742} - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992] - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992] - [rt] build kernel-rt-4.18.0-550.rt7.339.el8 [RHEL-5332] - mm/sparsemem: fix race in accessing memory_section->usage (Waiman Long) [RHEL-28875 RHEL-28876] {CVE-2023-52489} - mm: use __pfn_to_section() instead of open coding it (Waiman Long) [RHEL-28875] {CVE-2023-52489} - [rt] build kernel-rt-4.18.0-549.rt7.338.el8 [RHEL-5332] - dm-integrity: align the outgoing bio in integrity_recheck (Benjamin Marzinski) [RHEL-29678] - dm-integrity: fix a memory leak when rechecking the data (Benjamin Marzinski) [RHEL-29678] - RDMA/mana_ib: Add CQ interrupt support for RAW QP (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: query device capabilities (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: register RDMA device with GDMA (Maxim Levitsky) [RHEL-23934] - net: mana: add msix index sharing between EQs (Maxim Levitsky) [RHEL-23934] - net: mana: Fix spelling mistake "enforecement" -> "enforcement" (Maxim Levitsky) [RHEL-23934] - net :mana :Add remaining GDMA stats for MANA to ethtool (Maxim Levitsky) [RHEL-23934] - net: mana: Fix oversized sge0 for GSO packets (Maxim Levitsky) [RHEL-23934] - net: mana: Fix TX CQE error handling (Maxim Levitsky) [RHEL-23934] - net: mana: Add gdma stats to ethtool output for mana (Maxim Levitsky) [RHEL-23934] - net: mana: Fix MANA VF unload when hardware is unresponsive (Maxim Levitsky) [RHEL-23934] - net: mana: Configure hwc timeout from hardware (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (Maxim Levitsky) [RHEL-23934] - [rt] build kernel-rt-4.18.0-548.rt7.337.el8 [RHEL-5332] - gitlab-ci: enable arm64/s390x/ppc64le debug builds (Michael Hofmann) - arm64: Add missing bits of AmpereOne Spectre-BHB mitigation (Mark Salter) [RHEL-29005] - [rt] enable CONFIG_DRM_MGAG200_IOBURST_WORKAROUND (Jocelyn Falempe) [RHEL-13214] - drm/mgag200: Add a workaround for low-latency (Jocelyn Falempe) [RHEL-13214] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - [rt] build kernel-rt-4.18.0-553.8.1.rt7.349.el8_10 [RHEL-40882] - udf: Fix NULL pointer dereference in udf_symlink function (Pavel Reichl) [RHEL-37769] {CVE-2021-47353} - net: ti: fix UAF in tlan_remove_one (Jose Ignacio Tornos Martinez) [RHEL-38940] {CVE-2021-47310} - ARM: footbridge: fix PCI interrupt mapping (Myron Stowe) [RHEL-26971] {CVE-2021-46909} - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (Kamal Heib) [RHEL-37454] {CVE-2024-36004} - net/mlx5e: Fix mlx5e_priv_init() cleanup flow (Kamal Heib) [RHEL-37424] {CVE-2024-35959} - net/mlx5: Properly link new fs rules into the tree (Kamal Heib) [RHEL-37420] {CVE-2024-35960} - net/mlx5e: fix a potential double-free in fs_any_create_groups (Kamal Heib) [RHEL-37091] {CVE-2023-52667} - net: ena: Fix incorrect descriptor free behavior (Kamal Heib) [RHEL-37428] {CVE-2024-35958} - mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - mISDN: fix possible use-after-free in HFC_cleanup() (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - implement dh fallback for primes > 4K (Vladis Dronov) [RHEL-35106] - crypto: qat - avoid division by zero (Vladis Dronov) [RHEL-35106] - crypto: qat - resolve race condition during AER recovery (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - use kcalloc_node() instead of kzalloc_node() (Vladis Dronov) [RHEL-35106] - [rt] Enable CONFIG_DRM_MGAG200_DISABLE_WRITECOMBINE (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Add an option to disable Write-Combine (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Fix caching setup for remapped video memory (Jocelyn Falempe) [RHEL-36172] - Revert "drm/mgag200: Add a workaround for low-latency" (Jocelyn Falempe) [RHEL-36172] - mptcp: fix data re-injection from stale subflow (Davide Caratti) [RHEL-33133] {CVE-2024-26826} - ipv6: sr: fix incorrect unregister order (Hangbin Liu) [RHEL-31730] - ipv6: sr: fix possible use-after-free and null-ptr-deref (Hangbin Liu) [RHEL-31730] {CVE-2024-26735} - net/bnx2x: Prevent access to a freed page in page_pool (Michal Schmidt) [RHEL-14195 RHEL-33243] {CVE-2024-26859} - bnx2x: new flag for track HW resource allocation (Michal Schmidt) [RHEL-14195 RHEL-33243] - bnx2x: fix page fault following EEH recovery (Michal Schmidt) [RHEL-14195 RHEL-33243] - x86: KVM: SVM: always update the x2avic msr interception (Maxim Levitsky) [RHEL-15495] {CVE-2023-5090} - EDAC/thunderx: Fix possible out-of-bounds string access (Aristeu Rozanski) [RHEL-26573] {CVE-2023-52464} - [rt] build kernel-rt-4.18.0-553.7.1.rt7.348.el8_10 [RHEL-34640] - net: qcom/emac: fix UAF in emac_remove (Ken Cox) [RHEL-37834] {CVE-2021-47311} - perf/core: Bail out early if the request AUX area is out of bound (Michael Petlan) [RHEL-38268] {CVE-2023-52835} - crypto: pcrypt - Fix hungtask for PADATA_RESET (Herbert Xu) [RHEL-38171] {CVE-2023-52813} - drm/amdgpu: fix use-after-free bug (Jocelyn Falempe) [RHEL-31240] {CVE-2024-26656} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash (Ivan Vecera) [RHEL-37008] {CVE-2024-35854} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update (Ivan Vecera) [RHEL-37004] {CVE-2024-35855} - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (Ivan Vecera) [RHEL-37012] {CVE-2024-35853} - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work (Ivan Vecera) [RHEL-37016] {CVE-2024-35852} - mlxsw: spectrum_acl_tcam: Fix warning during rehash (Ivan Vecera) [RHEL-37480] {CVE-2024-36007} - can: peak_pci: peak_pci_remove(): fix UAF (Jose Ignacio Tornos Martinez) [RHEL-38419] {CVE-2021-47456} - usbnet: fix error return code in usbnet_probe() (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - usbnet: sanity check for maxpacket (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - net/mlx5e: fix a double-free in arfs_create_groups (Kamal Heib) [RHEL-36920] {CVE-2024-35835} - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds (Jose Ignacio Tornos Martinez) [RHEL-38220] {CVE-2023-52878} - net: cdc_eem: fix tx fixup skb leak (Jose Ignacio Tornos Martinez) [RHEL-38080] {CVE-2021-47236} - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Jose Ignacio Tornos Martinez) [RHEL-38113] {CVE-2023-52703} - usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() (Desnes Nunes) [RHEL-38248] {CVE-2023-52877} - usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (Desnes Nunes) [RHEL-38240] {CVE-2023-52781} - gro: fix ownership transfer (Xin Long) [RHEL-37226] {CVE-2024-35890} - tipc: fix kernel warning when sending SYN message (Xin Long) [RHEL-38109] {CVE-2023-52700} - erspan: make sure erspan_base_hdr is present in skb->head (Xin Long) [RHEL-37230] {CVE-2024-35888} - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() (Bryan Gurney) [RHEL-17366] - scsi: mpi3mr: Sanitise num_phys (Bryan Gurney) [RHEL-17366] - netfilter: nf_tables: use timestamp to check for set element timeout (Phil Sutter) [RHEL-38023] {CVE-2024-27397} - net/ipv6: SKB symmetric hash should incorporate transport ports (Sabrina Dubroca) [RHEL-32061] - crypto: s390/aes - Fix buffer overread in CTR mode (Herbert Xu) [RHEL-37089] {CVE-2023-52669} - net: Save and restore msg_namelen in sock_sendmsg (Jamie Bainbridge) [RHEL-35893] - net: prevent address rewrite in kernel_bind() (Jamie Bainbridge) [RHEL-35893] - net: prevent rewrite of msg_name in sock_sendmsg() (Jamie Bainbridge) [RHEL-35893] - net: replace calls to sock->ops->connect() with kernel_connect() (Jamie Bainbridge) [RHEL-35893] - net: Avoid address overwrite in kernel_connect (Jamie Bainbridge) [RHEL-35893] - wifi: iwlwifi: dbg-tlv: ensure NUL termination (Jose Ignacio Tornos Martinez) [RHEL-37026] {CVE-2024-35845} - wifi: mac80211: fix potential sta-link leak (Jose Ignacio Tornos Martinez) [RHEL-36916] {CVE-2024-35838} - wifi: nl80211: reject iftype change with mesh ID change (Jose Ignacio Tornos Martinez) [RHEL-36884] {CVE-2024-27410} - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (Jose Ignacio Tornos Martinez) [RHEL-36807] {CVE-2024-35789} - Bluetooth: Avoid potential use-after-free in hci_error_reset (David Marlin) [RHEL-31826] {CVE-2024-26801} - tls: disable async encrypt/decrypt (Sabrina Dubroca) [RHEL-26362 RHEL-26409 RHEL-26420] {CVE-2024-26585 CVE-2024-26583 CVE-2024-26584} - Squashfs: check the inode number is not the invalid value of zero (Phillip Lougher) [RHEL-35096] {CVE-2024-26982} - ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/msg.c: update and document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/sem.c: document and update memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: update/document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: remove duplicated code (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (Kamal Heib) [RHEL-30582] {CVE-2023-52626} - Revert "ACPI: bus: Rework system-level device notification handling" (Prarit Bhargava) [RHEL-21486] - hwrng: core - Fix page fault dead lock on mmap-ed hwrng (Prarit Bhargava) [RHEL-29485] {CVE-2023-52615} - [rt] build kernel-rt-4.18.0-553.6.1.rt7.347.el8_10 [RHEL-34640] - cxgb4: Properly lock TX queue for the selftest. (John B. Wyatt IV) [RHEL-8779] - powerpc/powernv: Add a null pointer check in opal_event_init() (Mamatha Inamdar) [RHEL-37058] {CVE-2023-52686} - crypto: rsa - add a check for allocation failure (Vladis Dronov) [RHEL-35361] - crypto: rsa - allow only odd e and restrict value in FIPS mode (Vladis Dronov) [RHEL-35361] - KEYS: use kfree_sensitive with key (Vladis Dronov) [RHEL-35361] - lib/mpi: Extend the MPI library (only mpi_*_bit() part) (Vladis Dronov) [RHEL-35361] - net: ip_tunnel: prevent perpetual headroom growth (Felix Maurer) [RHEL-31814] {CVE-2024-26804} - s390/cpum_cf: make crypto counters upward compatible across machine types (Tobias Huschle) [RHEL-36048] - RDMA/mlx5: Fix fortify source warning while accessing Eth segment (Kamal Heib) [RHEL-33162] {CVE-2024-26907} - ovl: fix leaked dentry (Miklos Szeredi) [RHEL-27306] {CVE-2021-46972} - x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - x86/mm/vsyscall: Consider vsyscall page part of user address space (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - x86/mm: Add vsyscall address helper (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - mm/swap: fix race when skipping swapcache (Rafael Aquini) [RHEL-31644] {CVE-2024-26759} - swap: fix do_swap_page() race with swapoff (Rafael Aquini) [RHEL-31644] {CVE-2024-26759} - mm/swapfile: use percpu_ref to serialize against concurrent swapoff (Rafael Aquini) [RHEL-31644] {CVE-2024-26759} - mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions() (Rafael Aquini) [RHEL-29294] {CVE-2023-52560} - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr (Jiri Benc) [RHEL-29783] - block: null_blk: Fix handling of fake timeout request (Ming Lei) [RHEL-8130] - null_blk: fix poll request timeout handling (Ming Lei) [RHEL-8130] - block: null_blk: end timed out poll request (Ming Lei) [RHEL-8130] - block: null_blk: only set set->nr_maps as 3 if active poll_queues is > 0 (Ming Lei) [RHEL-8130] - null_blk: allow zero poll queues (Ming Lei) [RHEL-8130] - null_blk: Fix handling of submit_queues and poll_queues attributes (Ming Lei) [RHEL-8130] - null_blk: poll queue support (Ming Lei) [RHEL-8130] - null_blk: fix command timeout completion handling (Ming Lei) [RHEL-8130] - platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (Prarit Bhargava) [RHEL-27790] {CVE-2021-47073} - Bluetooth: avoid memcmp() out of bounds warning (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: hci_event: Fix coding style (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: hci_event: Fix using memcmp when comparing keys (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: Reject connection with the device which has same BD_ADDR (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: hci_event: Ignore NULL link key (David Marlin) [RHEL-3017] {CVE-2020-26555} - ppp_async: limit MRU to 64K (Guillaume Nault) [RHEL-31353] {CVE-2024-26675} - powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (Mamatha Inamdar) [RHEL-37078] {CVE-2023-52675} - tcp: do not accept ACK of bytes we never sent (Xin Long) [RHEL-21952] - [rt] build kernel-rt-4.18.0-553.5.1.rt7.346.el8_10 [RHEL-34640] - tools/power/turbostat: Fix uncore frequency file string (David Arcari) [RHEL-29238] - tools/power turbostat: Expand probe_intel_uncore_frequency() (David Arcari) [RHEL-29238] - uio: Fix use-after-free in uio_open (Ricardo Robaina) [RHEL-26232] {CVE-2023-52439} - net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (Ken Cox) [RHEL-27316] {CVE-2021-47013} - keys: Fix linking a duplicate key to a keyring's assoc_array (David Howells) [RHEL-30772] - keys: Hoist locking out of __key_link_begin() (David Howells) [RHEL-30772] - keys: Break bits out of key_unlink() (David Howells) [RHEL-30772] - keys: Change keyring_serialise_link_sem to a mutex (David Howells) [RHEL-30772] - wifi: brcm80211: handle pmk_op allocation failure (Jose Ignacio Tornos Martinez) [RHEL-35150] {CVE-2024-27048} - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work (Jose Ignacio Tornos Martinez) [RHEL-35140] {CVE-2024-27052} - wifi: iwlwifi: mvm: ensure offloading TID queue exists (Jose Ignacio Tornos Martinez) [RHEL-35130] {CVE-2024-27056} - wifi: mt76: mt7921e: fix use-after-free in free_irq() (Jose Ignacio Tornos Martinez) [RHEL-34866] {CVE-2024-26892} - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete (Jose Ignacio Tornos Martinez) [RHEL-34189] {CVE-2024-26897} - wifi: iwlwifi: mvm: fix a crash when we run out of stations (Jose Ignacio Tornos Martinez) [RHEL-31547] {CVE-2024-26693} - wifi: iwlwifi: fix double-free bug (Jose Ignacio Tornos Martinez) [RHEL-31543] {CVE-2024-26694} - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (Jose Ignacio Tornos Martinez) [RHEL-29089] {CVE-2023-52594} - wifi: rt2x00: restart beacon queue when hardware reset (Jose Ignacio Tornos Martinez) [RHEL-29093] {CVE-2023-52595} - wifi: iwlwifi: fix a memory corruption (Jose Ignacio Tornos Martinez) [RHEL-28903] {CVE-2024-26610} - [rt] build kernel-rt-4.18.0-553.4.1.rt7.345.el8_10 [RHEL-34640] - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117] - net/mlx5e: Prevent deadlock while disabling aRFS (Kamal Heib) [RHEL-35041] {CVE-2024-27014} - x86/tsc: Defer marking TSC unstable to a worker (Wander Lairson Costa) [RHEL-32676] - x86/smpboot: Make TSC synchronization function call based (Wander Lairson Costa) [RHEL-32676] - net: usb: fix possible use-after-free in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - net: usb: fix memory leak in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - [rt] build kernel-rt-4.18.0-552.3.1.rt7.344.el8_10 [RHEL-34640] - netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (Phil Sutter) [RHEL-30076] {CVE-2024-26643} - netfilter: nf_tables: disallow anonymous set with timeout flag (Phil Sutter) [RHEL-30080] {CVE-2024-26642} - selftests/bpf: Fix pyperf180 compilation failure with clang18 (Artem Savkov) [RHEL-35576] - md/raid5: fix atomicity violation in raid5_cache_count (Nigel Croxon) [RHEL-27930] {CVE-2024-23307} - usb: ulpi: Fix debugfs directory leak (Desnes Nunes) [RHEL-33287] {CVE-2024-26919} - powerpc/pseries: Fix potential memleak in papr_get_attr() (Mamatha Inamdar) [RHEL-35213] {CVE-2022-48669} - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (Desnes Nunes) [RHEL-35122] {CVE-2024-27059} - NFSv4: fairly test all delegations on a SEQ4_ revocation (Benjamin Coddington) [RHEL-34912] - USB: core: Fix deadlock in usb_deauthorize_interface() (Desnes Nunes) [RHEL-35002] {CVE-2024-26934} - usb: xhci: Add error handling in xhci_map_urb_for_dma (Desnes Nunes) [RHEL-34958] {CVE-2024-26964} - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (Ewan D. Milne) [RHEL-35076] {CVE-2024-26993} - xhci: handle isoc Babble and Buffer Overrun events properly (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - xhci: process isoc TD properly when there was a transaction error mid TD. (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - USB: core: Fix deadlock in port "disable" sysfs attribute (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - USB: core: Add hub_get() and hub_put() routines (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - netfilter: ipset: Missing gc cancellations fixed (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix performance regression in swap operation (Phil Sutter) [RHEL-30521] - netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test (Phil Sutter) [RHEL-30521] - x86/apic/x2apic: Fix a NULL pointer deref when handling a dying cpu (David Arcari) [RHEL-32516] - x86/coco: Disable 32-bit emulation by default on TDX and SEV (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Make IA32_EMULATION boot time configurable (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/elf: Make loading of 32bit processes depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Rename ignore_sysret() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/cpu: Don't write CSTAR MSR on Intel CPUs (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Introduce ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - [rt] build kernel-rt-4.18.0-552.2.1.rt7.343.el8_10 [RHEL-34640] - s390/ptrace: handle setting of fpc register correctly (Tobias Huschle) [RHEL-29106] {CVE-2023-52598} - net/smc: fix illegal rmb_desc access in SMC-D connection dump (Tobias Huschle) [RHEL-27746] {CVE-2024-26615} - wifi: mac80211: fix race condition on enabling fast-xmit (Jose Ignacio Tornos Martinez) [RHEL-31664] {CVE-2024-26779} - powerpc/fadump: make is_kdump_kernel() return false when fadump is active (Mamatha Inamdar) [RHEL-24401] - vmcore: remove dependency with is_kdump_kernel() for exporting vmcore (Mamatha Inamdar) [RHEL-24401] - mtd: require write permissions for locking and badblock ioctls (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - mtd: properly check all write ioctls for permissions (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - pid: take a reference when initializing `cad_pid` (Waiman Long) [RHEL-29420] {CVE-2021-47118} - i2c: i801: Don't generate an interrupt on bus reset (Prarit Bhargava) [RHEL-30325] {CVE-2021-47153} - RDMA/srpt: Do not register event handler until srpt device is fully setup (Kamal Heib) [RHEL-33224] {CVE-2024-26872} - ceph: switch to corrected encoding of max_xattr_size in mdsmap (Xiubo Li) [RHEL-26723] - ceph: switch to use cap_delay_lock for the unlink delay list (Xiubo Li) [RHEL-32870] - ceph: pass ino# instead of old_dentry if it's disconnected (Xiubo Li) [RHEL-32870] - fat: fix uninitialized field in nostale filehandles (Andrey Albershteyn) [RHEL-33186 RHEL-35108] {CVE-2024-26973} - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (Andrey Albershteyn) [RHEL-33186] {CVE-2024-26901} - idpf: limit the support to GCP only (Michal Schmidt) [RHEL-15652] - redhat/configs: enable CONFIG_IDPF (Michal Schmidt) [RHEL-15652] - idpf: remove the use of ETHTOOL_RING_USE_TCP_DATA_SPLIT (Michal Schmidt) [RHEL-15652] - idpf: workaround for unavailable skb page recycling (Michal Schmidt) [RHEL-15652] - idpf: always allocate a full page (Michal Schmidt) [RHEL-15652] - idpf: remove page pool stats code (Michal Schmidt) [RHEL-15652] - idpf: add minimal macros for __free(kfree) to work (Michal Schmidt) [RHEL-15652] - idpf: fixup include paths for RHEL 8 (Michal Schmidt) [RHEL-15652] - idpf: fix kernel panic on unknown packet types (Michal Schmidt) [RHEL-15652] - idpf: disable local BH when scheduling napi for marker packets (Michal Schmidt) [RHEL-15652] - idpf: remove dealloc vector msg err in idpf_intr_rel (Michal Schmidt) [RHEL-15652] - idpf: fix minor controlq issues (Michal Schmidt) [RHEL-15652] - idpf: prevent deinit uninitialized virtchnl core (Michal Schmidt) [RHEL-15652] - idpf: cleanup virtchnl cruft (Michal Schmidt) [RHEL-15652] - idpf: refactor idpf_recv_mb_msg (Michal Schmidt) [RHEL-15652] - idpf: add async_handler for MAC filter messages (Michal Schmidt) [RHEL-15652] - idpf: refactor remaining virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor queue related virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor vport virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: implement virtchnl transaction manager (Michal Schmidt) [RHEL-15652] - idpf: add idpf_virtchnl.h (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler padding in virtchnl2_ptype struct (Michal Schmidt) [RHEL-15652] - idpf: distinguish vports by the dev_port attribute (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler introduced padding in virtchnl2_rss_key struct (Michal Schmidt) [RHEL-15652] - idpf: fix corrupted frames and skb leaks in singleq mode (Michal Schmidt) [RHEL-15652] - idpf: refactor some missing field get/prep conversions (Michal Schmidt) [RHEL-15652] - idpf: add get/set for Ethtool's header split ringparam (Michal Schmidt) [RHEL-15652] - idpf: fix potential use-after-free in idpf_tso() (Michal Schmidt) [RHEL-15652] - idpf: cancel mailbox work in error path (Michal Schmidt) [RHEL-15652] - idpf: set scheduling mode for completion queue (Michal Schmidt) [RHEL-15652] - idpf: add SRIOV support and other ndo_ops (Michal Schmidt) [RHEL-15652] - idpf: add ethtool callbacks (Michal Schmidt) [RHEL-15652] - idpf: add singleq start_xmit and napi poll (Michal Schmidt) [RHEL-15652] - idpf: add RX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add TX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add splitq start_xmit (Michal Schmidt) [RHEL-15652] - idpf: initialize interrupts and enable vport (Michal Schmidt) [RHEL-15652] - idpf: configure resources for RX queues (Michal Schmidt) [RHEL-15652] - idpf: configure resources for TX queues (Michal Schmidt) [RHEL-15652] - idpf: add ptypes and MAC filter support (Michal Schmidt) [RHEL-15652] - idpf: add create vport and netdev configuration (Michal Schmidt) [RHEL-15652] - idpf: add core init and interrupt request (Michal Schmidt) [RHEL-15652] - idpf: add controlq init and reset checks (Michal Schmidt) [RHEL-15652] - idpf: add module register and probe functionality (Michal Schmidt) [RHEL-15652] - virtchnl: add virtchnl version 2 ops (Michal Schmidt) [RHEL-15652] - net: netdev_queue: netdev_txq_completed_mb(): fix wake condition (Michal Schmidt) [RHEL-15652] - net: piggy back on the memory barrier in bql when waking queues (Michal Schmidt) [RHEL-15652] - net: provide macros for commonly copied lockless queue stop/wake code (Michal Schmidt) [RHEL-15652] - [rt] build kernel-rt-4.18.0-552.1.1.rt7.342.el8_10 [RHEL-34640] - build: Update RTBZ for 8.10 z-stream builds (Denys Vlasenko) - redhat: set DIST to el8_10 and ZSTREAM to yes for 8.10 (Denys Vlasenko) - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (Prarit Bhargava) [RHEL-32590] {CVE-2021-47185} - net: mana: Fix Rx DMA datasize and skb_over_panic (Cathy Avery) [RHEL-32579] - RDMA/srpt: Support specifying the srpt_service_guid parameter (Kamal Heib) [RHEL-31710] {CVE-2024-26744} - RDMA/qedr: Fix qedr_create_user_qp error flow (Kamal Heib) [RHEL-31714] {CVE-2024-26743} - hwmon: (coretemp) Fix out-of-bounds memory access (David Arcari) [RHEL-31305] {CVE-2024-26664} - RDMA/irdma: Fix KASAN issue with tasklet (Kamal Heib) [RHEL-15776] - net: bridge: use DEV_STATS_INC() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: Fix unwanted sign extension in netdev_stats_to_stats64() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: add atomic_long_t to net_device_stats fields (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net/sched: act_ct: fix skb leak and crash on ooo frags (Xin Long) [RHEL-29467] {CVE-2023-52610} - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Jose Ignacio Tornos Martinez) [RHEL-28015] {CVE-2023-52528} - RDMA/core: Fix uninit-value access in ib_get_eth_speed() (Kamal Heib) [RHEL-30130] - RDMA/core: Get IB width and speed from netdev (Kamal Heib) [RHEL-30130] - cpufreq: intel_pstate: Add Emerald Rapids support in no-HWP mode (Prarit Bhargava) [RHEL-29444] - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add (Mamatha Inamdar) [RHEL-29118] {CVE-2023-52607} - powerpc/lib: Validate size for vector operations (Mamatha Inamdar) [RHEL-29114] {CVE-2023-52606} - usb: hub: Guard against accesses to uninitialized BOS descriptors (Desnes Nunes) [RHEL-28986] {CVE-2023-52477} - media: uvcvideo: Fix OOB read (Desnes Nunes) [RHEL-27940] {CVE-2023-52565} - media: pvrusb2: fix use after free on context disconnection (Desnes Nunes) [RHEL-26498] {CVE-2023-52445} - i2c: i801: Fix block process call transactions (Prarit Bhargava) [RHEL-26478] {CVE-2024-26593} - overlay: disable EVM (Coiby Xu) [RHEL-19863] - evm: add support to disable EVM on unsupported filesystems (Coiby Xu) [RHEL-19863] - evm: don't copy up 'security.evm' xattr (Coiby Xu) [RHEL-19863] - net: ena: Remove ena_select_queue (Kamal Heib) [RHEL-14286] - media: dvbdev: Fix memory leak in dvb_media_device_free() (Prarit Bhargava) [RHEL-27254] {CVE-2020-36777} - gfs2: Fix invalid metadata access in punch_hole (Andrew Price) [RHEL-28784] - i2c: Fix a potential use after free (Prarit Bhargava) [RHEL-26849] {CVE-2019-25162} - i2c: validate user data in compat ioctl (Prarit Bhargava) [RHEL-27022] {CVE-2021-46934} - platform/x86: think-lmi: Fix reference leak (Prarit Bhargava) [RHEL-28030] {CVE-2023-52520} - vhost: use kzalloc() instead of kmalloc() followed by memset() (Jon Maloy) [RHEL-21505] {CVE-2024-0340} - RDMA/siw: Fix connection failure handling (Kamal Heib) [RHEL-28042] {CVE-2023-52513} - vt: fix memory overlapping when deleting chars in the buffer (Waiman Long) [RHEL-27778 RHEL-27779] {CVE-2022-48627} - x86/fpu: Stop relying on userspace for info to fault in xsave buffer (Steve Best) [RHEL-26669] {CVE-2024-26603} - mptcp: fix double-free on socket dismantle (Davide Caratti) [RHEL-22773] {CVE-2024-26782} - crypto: akcipher - Disable signing and decryption (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: akcipher - default implementations for request callbacks (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: testmgr - split akcipher tests by a key type (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - workqueue: Warn when a rescuer could not be created (Waiman Long) [RHEL-22136] - RDMA/cma: Avoid GID lookups on iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/cma: Deduplicate error flow in cma_validate_port() (Benjamin Coddington) [RHEL-12456] - RDMA/core: Set gid_attr.ndev for iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/siw: Fabricate a GID on tun and loopback devices (Benjamin Coddington) [RHEL-12456] - eventpoll: fix missing wakeup for ovflist in ep_poll_callback (Luis Claudio R. Goncalves) [RHEL-23022] - [rt] build kernel-rt-4.18.0-552.rt7.341.el8 [RHEL-5332] - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248] - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248] - [rt] build kernel-rt-4.18.0-551.rt7.340.el8 [RHEL-5332] - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742} - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992] - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825} - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237] - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724} - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513} - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921] - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921] - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921] - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921] - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921] - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774] - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660] - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660] - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199] - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539} - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825} - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237] - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724} - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513} - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921] - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921] - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921] - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921] - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921] - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285} - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993} - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396] - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396] - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396] - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396] - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355] - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355] - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355] - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355] - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355] - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355] - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240} - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek) - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963] - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171] - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171] - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226] - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226] - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744] - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744] - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744] - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744] - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew) [RHEL-129945] - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774] - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660] - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660] - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199] - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539} - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825} - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237] - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724} - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513} - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921] - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921] - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921] - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921] - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921] - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301} - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933} - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051} - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449] - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096} - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285} - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993} - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396] - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396] - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396] - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396] - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355] - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355] - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355] - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355] - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355] - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355] - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240} - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek) - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963] - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171] - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171] - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226] - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226] - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744] - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744] - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744] - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744] - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew) [RHEL-129945] - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774] - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660] - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660] - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199] - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539} - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - Bluetooth: hci_event: call disconnect callback before deleting conn (CKI Backport Bot) [RHEL-137039] {CVE-2023-53673} - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CKI Backport Bot) [RHEL-134423] {CVE-2025-40277} - xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 (John J Coleman) [RHEL-111354] - xen: Fix x86 sched_clock() interface for xen (John J Coleman) [RHEL-111354] - x86/xen/time: Output xen sched_clock time from 0 (John J Coleman) [RHEL-111354] - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Olga Kornievskaia) [RHEL-132819] - vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139273] {CVE-2025-40248} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ignore ndlp rport mismatch in dev_loss_tmo callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Modify handling of ADISC based on ndlp state and RPI registration (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Delete NLP_TARGET_REMOVE flag due to obsolete usage (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo callback (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Check devloss callbk done flag for potential stale NDLP ptrs (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kref imbalance on fabric ndlps from dev_loss_tmo handler (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Update PRLO handling in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Add condition to delete ndlp object after sending BLS_RJT to an ABTS (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove NLP_RCV_PLOGI early return during RSCN processing for ndlps (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Allow lpfc_plogi_confirm_nport() logic to execute for Fabric nodes (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix list_entry null check warning in lpfc_cmpl_els_plogi() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix possible file string name overflow when updating firmware (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Validate ELS LS_ACC completion payload (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove extra ndlp kref decrement in FLOGI cmpl for loop topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Revise NPIV ELS unsol rcv cmpl logic to drop ndlp based on nlp_state (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix double free in lpfc_cmpl_els_logo_acc() caused by lpfc_nlp_not_used() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Move scsi_host_template outside dynamically allocated/freed phba (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fill in missing ndlp kref puts in error paths (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login (Ewan D. Milne) [RHEL-32324] - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301} - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933} - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051} - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449] - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096} - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285} - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993} - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396] - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396] - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396] - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396] - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355] - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355] - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355] - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355] - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355] - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355] - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240} - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek) - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963] - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171] - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171] - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226] - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226] - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744] - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744] - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744] - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744] - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew) [RHEL-129945] - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117] - [rt] build kernel-rt-4.18.0-552.rt7.341.el8 [RHEL-5332] - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248] - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248] - [rt] build kernel-rt-4.18.0-551.rt7.340.el8 [RHEL-5332] - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742} - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992] - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992] - [rt] build kernel-rt-4.18.0-550.rt7.339.el8 [RHEL-5332] - mm/sparsemem: fix race in accessing memory_section->usage (Waiman Long) [RHEL-28875 RHEL-28876] {CVE-2023-52489} - mm: use __pfn_to_section() instead of open coding it (Waiman Long) [RHEL-28875] {CVE-2023-52489} - [rt] build kernel-rt-4.18.0-549.rt7.338.el8 [RHEL-5332] - dm-integrity: align the outgoing bio in integrity_recheck (Benjamin Marzinski) [RHEL-29678] - dm-integrity: fix a memory leak when rechecking the data (Benjamin Marzinski) [RHEL-29678] - RDMA/mana_ib: Add CQ interrupt support for RAW QP (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: query device capabilities (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: register RDMA device with GDMA (Maxim Levitsky) [RHEL-23934] - net: mana: add msix index sharing between EQs (Maxim Levitsky) [RHEL-23934] - net: mana: Fix spelling mistake "enforecement" -> "enforcement" (Maxim Levitsky) [RHEL-23934] - net :mana :Add remaining GDMA stats for MANA to ethtool (Maxim Levitsky) [RHEL-23934] - net: mana: Fix oversized sge0 for GSO packets (Maxim Levitsky) [RHEL-23934] - net: mana: Fix TX CQE error handling (Maxim Levitsky) [RHEL-23934] - net: mana: Add gdma stats to ethtool output for mana (Maxim Levitsky) [RHEL-23934] - net: mana: Fix MANA VF unload when hardware is unresponsive (Maxim Levitsky) [RHEL-23934] - net: mana: Configure hwc timeout from hardware (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (Maxim Levitsky) [RHEL-23934] - [rt] build kernel-rt-4.18.0-548.rt7.337.el8 [RHEL-5332] - gitlab-ci: enable arm64/s390x/ppc64le debug builds (Michael Hofmann) - arm64: Add missing bits of AmpereOne Spectre-BHB mitigation (Mark Salter) [RHEL-29005] - [rt] enable CONFIG_DRM_MGAG200_IOBURST_WORKAROUND (Jocelyn Falempe) [RHEL-13214] - drm/mgag200: Add a workaround for low-latency (Jocelyn Falempe) [RHEL-13214] - [rt] build kernel-rt-4.18.0-547.rt7.336.el8 [RHEL-5332] - x86/efistub: Avoid placing the kernel below LOAD_PHYSICAL_ADDR (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Give up if memory attribute protocol returns an error (Lenny Szubowicz) [RHEL-2505] - x86/boot: Increase section and file alignment to 4k/512 (Lenny Szubowicz) [RHEL-2505] - x86/boot: Split off PE/COFF .data section (Lenny Szubowicz) [RHEL-2505] - x86/boot: Drop PE/COFF .reloc section (Lenny Szubowicz) [RHEL-2505] - x86/boot: Construct PE/COFF .text section from assembler (Lenny Szubowicz) [RHEL-2505] - x86/boot: Derive file size from _edata symbol (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed: Remove, discard, or assert for unwanted sections (Lenny Szubowicz) [RHEL-2505] - x86/boot: Check that there are no run-time relocations (Lenny Szubowicz) [RHEL-2505] - x86/boot: Discard .discard.unreachable for arch/x86/boot/compressed/vmlinux (Lenny Szubowicz) [RHEL-2505] - x86/boot: Define setup size in linker script (Lenny Szubowicz) [RHEL-2505] - x86/boot: Set EFI handover offset directly in header asm (Lenny Szubowicz) [RHEL-2505] - x86/boot: Drop references to startup_64 (Lenny Szubowicz) [RHEL-2505] - x86/boot: Drop redundant code setting the root device (Lenny Szubowicz) [RHEL-2505] - x86/build: Declutter the build output (Lenny Szubowicz) [RHEL-2505] - x86/boot: Omit compression buffer from PE/COFF image memory footprint (Lenny Szubowicz) [RHEL-2505] - x86/boot: Mark global variables as static (Lenny Szubowicz) [RHEL-2505] - efi/x86: Remove extra headroom for setup block (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove the 'bugger off' message (Lenny Szubowicz) [RHEL-2505] - x86/efi: Drop alignment flags from PE section headers (Lenny Szubowicz) [RHEL-2505] - efi: Put Linux specific magic number in the DOS header (Lenny Szubowicz) [RHEL-2505] - efi/x86: Fix the missing KASLR_FLAG bit in boot_params->hdr.loadflags (Lenny Szubowicz) [RHEL-2505] - efi/x86: Avoid physical KASLR on older Dell systems (Lenny Szubowicz) [RHEL-2505] - x86/boot: efistub: Assign global boot_params variable (Lenny Szubowicz) [RHEL-2505] - x86/boot: Rename conflicting 'boot_params' pointer to 'boot_params_ptr' (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Avoid legacy decompressor when doing EFI boot (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Perform SNP feature test while running in the firmware (Lenny Szubowicz) [RHEL-2505] - x86/sev: Do not try to parse for the CC blob on non-AMD hardware (Lenny Szubowicz) [RHEL-2505] - efi/libstub: Add limit argument to efi_random_alloc() (Lenny Szubowicz) [RHEL-2505] - arm64: efi: Limit allocations to 48-bit addressable physical region (Lenny Szubowicz) [RHEL-2505] - efi: libstub: use EFI_LOADER_CODE region when moving the kernel in memory (Lenny Szubowicz) [RHEL-2505] - arm64: efi: kaslr: Fix occasional random alloc (and boot) failure (Lenny Szubowicz) [RHEL-2505] - efi/libstub/random: Increase random alloc granularity (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Factor out kernel decompression and relocation (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Move global symbol references to C code (Lenny Szubowicz) [RHEL-2505] - decompress: Use 8 byte alignment (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Prefer EFI memory attributes protocol over DXE services (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Perform 4/5 level paging switch from the stub (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Merge trampoline cleanup with switching code (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Pass pgtable address to trampoline directly (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Only call the trampoline when changing paging levels (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Call trampoline directly from C code (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Avoid the need for a stack in the 32-bit trampoline (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Use standard calling convention for trampoline (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Call trampoline as a normal function (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Remove .bss/.pgtable from bzImage (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove run-time relocations from .head.text code (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Assign paging related global variables earlier (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Store boot_params pointer in callee save register (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Clear BSS in EFI handover protocol entrypoint (Lenny Szubowicz) [RHEL-2505] - x86/head_64: Store boot_params pointer in callee save register (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Don't rely on upper 32 bits of GPRs being preserved (Lenny Szubowicz) [RHEL-2505] - x86/head/64: Switch to KERNEL_CS as soon as new GDT is installed (Lenny Szubowicz) [RHEL-2505] - efi/libstub: Add memory attribute protocol definitions (Lenny Szubowicz) [RHEL-2505] - efi/x86: libstub: remove unused variable (Lenny Szubowicz) [RHEL-2505] - x86/boot: Robustify calling startup_{32,64}() from the decompressor code (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Simplify and clean up handover entry code (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Branch straight to kernel entry point from C code (Lenny Szubowicz) [RHEL-2505] - efi/x86: Avoid using code32_start (Lenny Szubowicz) [RHEL-2505] - efi/libstub/x86: Use Exit() boot service to exit the stub on errors (Lenny Szubowicz) [RHEL-2505] - efi: x86: Wipe setup_data on pure EFI boot (Lenny Szubowicz) [RHEL-2505] - efi: x86: Fix config name for setting the NX-compatibility flag in the PE header (Lenny Szubowicz) [RHEL-2505] - efi: x86: Set the NX-compatibility flag in the PE header (Lenny Szubowicz) [RHEL-2505] - efi/x86: Add kernel preferred address to PE header (Lenny Szubowicz) [RHEL-2505] - efi/x86: Use symbolic constants in PE header instead of bare numbers (Lenny Szubowicz) [RHEL-2505] - efi/x86: Drop redundant .bss section (Lenny Szubowicz) [RHEL-2505] - efi/x86: add headroom to decompressor BSS to account for setup block (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove run-time relocations from head_{32,64}.S (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed: Fix debug_puthex() parameter type (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Use 32-bit (zero-extended) MOV for z_output_len (Lenny Szubowicz) [RHEL-2505] - x86/boot: Use unsigned comparison for addresses (Lenny Szubowicz) [RHEL-2505] - x86/boot: Micro-optimize GDT loading instructions (Lenny Szubowicz) [RHEL-2505] - x86/boot: GDT limit value should be size - 1 (Lenny Szubowicz) [RHEL-2505] - efi/x86: Remove GDT setup from efi_main (Lenny Szubowicz) [RHEL-2505] - x86/boot: Clear direction and interrupt flags in startup_64 (Lenny Szubowicz) [RHEL-2505] - efi/x86: Don't depend on firmware GDT layout (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove KEEP_SEGMENTS support (Lenny Szubowicz) [RHEL-2505] - x86/boot: Handle malformed SRAT tables during early ACPI parsing (Lenny Szubowicz) [RHEL-2505] - efi/libstub/x86: Use mandatory 16-byte stack alignment in mixed mode (Lenny Szubowicz) [RHEL-2505] - efi/libstub/x86: Avoid globals to store context during mixed mode calls (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Disable paging at mixed mode entry (Lenny Szubowicz) [RHEL-2505] - x86: efi/random: Invoke EFI_RNG_PROTOCOL to seed the UEFI RNG table (Lenny Szubowicz) [RHEL-2505] - x86/asm: Make some functions local (Lenny Szubowicz) [RHEL-2505] - x86/boot: Annotate data appropriately (Lenny Szubowicz) [RHEL-2505] - x86/boot: Annotate local functions (Lenny Szubowicz) [RHEL-2505] - x86/asm: Make more symbols local (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Fix missing initialization in find_trampoline_placement() (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Fix boot on machines with broken E820 table (Lenny Szubowicz) [RHEL-2505] - x86, boot: Remove multiple copy of static function sanitize_boot_params() (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Remove unused variable (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Explain paging_prepare()'s return value (Lenny Szubowicz) [RHEL-2505] - x86/boot: Save several bytes in decompressor (Lenny Szubowicz) [RHEL-2505] - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (Audra Mitchell) [RHEL-20614] {CVE-2024-0841} - net/gve: update check for little-endianness in gve kconfig (Joshua Washington) [RHEL-29030] - [rt] build kernel-rt-4.18.0-546.rt7.335.el8 [RHEL-5332] - sched/membarrier: reduce the ability to hammer on sys_membarrier (Wander Lairson Costa) [RHEL-23430] {CVE-2024-26602} - NFS: Set the stable writes flag when initialising the super block (Benjamin Coddington) [RHEL-25266] - smb: client: fix OOB in receive_encrypted_standard() (Scott Mayhew) [RHEL-21685] {CVE-2024-0565} - scsi: core: Move scsi_host_busy() out of host lock if it is for per-command (Ming Lei) [RHEL-23942] - scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler (Ming Lei) [RHEL-23942] - gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump (Andrew Price) [RHEL-26501] {CVE-2023-52448} - smb: client: fix parsing of SMB3.1.1 POSIX create context (Paulo Alcantara) [RHEL-26241] {CVE-2023-52434} - smb: client: fix potential OOBs in smb2_parse_contexts() (Paulo Alcantara) [RHEL-26241] {CVE-2023-52434} - smb3: Replace smb2pdu 1-element arrays with flex-arrays (Jay Shin) [RHEL-22143] - cifs: Replace remaining 1-element arrays (Jay Shin) [RHEL-22143] - cifs: Convert struct fealist away from 1-element array (Jay Shin) [RHEL-22143] - cifs: remove unneeded 2bytes of padding from smb2 tree connect (Jay Shin) [RHEL-22143] - cifs: Replace zero-length arrays with flexible-array members (Jay Shin) [RHEL-22143] - cifs: Replace a couple of one-element arrays with flexible-array members (Jay Shin) [RHEL-22143] - cifs: fix FILE_BOTH_DIRECTORY_INFO definition (Jay Shin) [RHEL-22143] - nfsd: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - nfs: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - lockd: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - cifs: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - ceph: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - filelock: add a new locks_inode_context accessor function (Jeffrey Layton) [RHEL-27441] - dm-integrity, dm-verity: reduce stack usage for recheck (Benjamin Marzinski) [RHEL-27849] - dm-crypt: recheck the integrity tag after a failure (Benjamin Marzinski) [RHEL-27849] - dm-crypt: don't modify the data when using authenticated encryption (Benjamin Marzinski) [RHEL-27849] - dm-verity: recheck the hash after a failure (Benjamin Marzinski) [RHEL-27849] - dm-integrity: recheck the integrity tag after a failure (Benjamin Marzinski) [RHEL-27849] - [rt] build kernel-rt-4.18.0-545.rt7.334.el8 [RHEL-5332] - tracing/timerlat: Move hrtimer_init to timerlat_fd open() (John Kacur) [RHEL-26667] - tracing/perf: Fix double put of trace event when init fails (Michael Petlan) [RHEL-19537] - ipvlan: Add handling of NETDEV_UP events (Hangbin Liu) [RHEL-19098] - ceph: add ceph_cap_unlink_work to fire check_caps() immediately (Xiubo Li) [RHEL-21760] - ceph: always queue a writeback when revoking the Fb caps (Xiubo Li) [RHEL-21760] - ceph: always check dir caps asynchronously (Xiubo Li) [RHEL-21760] - nfs: fix redundant readdir request after get eof (Benjamin Coddington) [RHEL-7780] - NFSv4.1: fixup use EXCHGID4_FLAG_USE_PNFS_DS for DS server (Scott Mayhew) [RHEL-7994] - NFSv4.1: fix pnfs MDS=DS session trunking (Scott Mayhew) [RHEL-7994] - NFSv4.1: fix zero value filehandle in post open getattr (Scott Mayhew) [RHEL-7994] - NFSv4.1: use EXCHGID4_FLAG_USE_PNFS_DS for DS server (Scott Mayhew) [RHEL-7994] - x86/boot: Ignore NMIs during very early boot (Valentin Schneider) [RHEL-22749] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - vfs: use READ_ONCE() to access ->i_link (Jay Shin) [RHEL-141790] - fold generic_readlink() into its only caller (Jay Shin) [RHEL-141790] - fs/proc: fix uaf in proc_readdir_de() (Pavel Reichl) [RHEL-137093] {CVE-2025-40271} - Backport 'create an empty changelog file when changing its name' (Alexandra Hájková) - mptcp: fix race condition in mptcp_schedule_work() (Paolo Abeni) [RHEL-134443] {CVE-2025-40258} - mptcp: use mptcp_schedule_work instead of open-coding it (Paolo Abeni) [RHEL-134443] - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - tcp: minor optimization in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Kamal Heib) [RHEL-134347] {CVE-2025-38022} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - Bluetooth: hci_event: call disconnect callback before deleting conn (CKI Backport Bot) [RHEL-137039] {CVE-2023-53673} - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CKI Backport Bot) [RHEL-134423] {CVE-2025-40277} - xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 (John J Coleman) [RHEL-111354] - xen: Fix x86 sched_clock() interface for xen (John J Coleman) [RHEL-111354] - x86/xen/time: Output xen sched_clock time from 0 (John J Coleman) [RHEL-111354] - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Olga Kornievskaia) [RHEL-132819] - vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139273] {CVE-2025-40248} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ignore ndlp rport mismatch in dev_loss_tmo callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Modify handling of ADISC based on ndlp state and RPI registration (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Delete NLP_TARGET_REMOVE flag due to obsolete usage (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo callback (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Check devloss callbk done flag for potential stale NDLP ptrs (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kref imbalance on fabric ndlps from dev_loss_tmo handler (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Update PRLO handling in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Add condition to delete ndlp object after sending BLS_RJT to an ABTS (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove NLP_RCV_PLOGI early return during RSCN processing for ndlps (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Allow lpfc_plogi_confirm_nport() logic to execute for Fabric nodes (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix list_entry null check warning in lpfc_cmpl_els_plogi() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix possible file string name overflow when updating firmware (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Validate ELS LS_ACC completion payload (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove extra ndlp kref decrement in FLOGI cmpl for loop topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Revise NPIV ELS unsol rcv cmpl logic to drop ndlp based on nlp_state (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix double free in lpfc_cmpl_els_logo_acc() caused by lpfc_nlp_not_used() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Move scsi_host_template outside dynamically allocated/freed phba (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fill in missing ndlp kref puts in error paths (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login (Ewan D. Milne) [RHEL-32324] - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301} - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933} - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051} - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449] - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096} - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - vfs: use READ_ONCE() to access ->i_link (Jay Shin) [RHEL-141790] - fold generic_readlink() into its only caller (Jay Shin) [RHEL-141790] - fs/proc: fix uaf in proc_readdir_de() (Pavel Reichl) [RHEL-137093] {CVE-2025-40271} - Backport 'create an empty changelog file when changing its name' (Alexandra Hájková) - mptcp: fix race condition in mptcp_schedule_work() (Paolo Abeni) [RHEL-134443] {CVE-2025-40258} - mptcp: use mptcp_schedule_work instead of open-coding it (Paolo Abeni) [RHEL-134443] - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - tcp: minor optimization in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Kamal Heib) [RHEL-134347] {CVE-2025-38022} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - vfs: use READ_ONCE() to access ->i_link (Jay Shin) [RHEL-141790] - fold generic_readlink() into its only caller (Jay Shin) [RHEL-141790] - fs/proc: fix uaf in proc_readdir_de() (Pavel Reichl) [RHEL-137093] {CVE-2025-40271} - Backport 'create an empty changelog file when changing its name' (Alexandra Hájková) - mptcp: fix race condition in mptcp_schedule_work() (Paolo Abeni) [RHEL-134443] {CVE-2025-40258} - mptcp: use mptcp_schedule_work instead of open-coding it (Paolo Abeni) [RHEL-134443] - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - tcp: minor optimization in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Kamal Heib) [RHEL-134347] {CVE-2025-38022} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - autofs: use wake_up() instead of wake_up_interruptible(() (Ian Kent) [RHEL-143685] - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Ian Kent) [RHEL-143685] {CVE-2023-54134} - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141709] - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-136693] - audit: merge loops in __audit_inode_child() (Ricardo Robaina) [RHEL-140442] - bridge: mcast: Fix use-after-free during router port configuration (Mohammad Heib) [RHEL-138422] {CVE-2025-38248} - net/sched: Enforce that teql can only be used as root qdisc (CKI Backport Bot) [RHEL-146992] {CVE-2026-23074} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Marc Milgram) [RHEL-137838] {CVE-2025-38129} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143189] {CVE-2025-68800} - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126886] {CVE-2025-40064} - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147261] {CVE-2026-23097} - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-134673] - autofs: use wake_up() instead of wake_up_interruptible(() (Ian Kent) [RHEL-143685] - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Ian Kent) [RHEL-143685] {CVE-2023-54134} - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141709] - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-136693] - audit: merge loops in __audit_inode_child() (Ricardo Robaina) [RHEL-140442] - bridge: mcast: Fix use-after-free during router port configuration (Mohammad Heib) [RHEL-138422] {CVE-2025-38248} - net/sched: Enforce that teql can only be used as root qdisc (CKI Backport Bot) [RHEL-146992] {CVE-2026-23074} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Marc Milgram) [RHEL-137838] {CVE-2025-38129} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143189] {CVE-2025-68800} - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126886] {CVE-2025-40064} - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - macvlan: fix possible UAF in macvlan_forward_source() (Hangbin Liu) [RHEL-144120] {CVE-2026-23001} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-131922] - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount (Jocelyn Falempe) [RHEL-148636] - audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd references (Waiman Long) [RHEL-146026] - fs: Add a pool of extra fs->pwd references to fs_struct (Waiman Long) [RHEL-146026] - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143535] {CVE-2025-71085} - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147261] {CVE-2026-23097} - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-134673] - autofs: use wake_up() instead of wake_up_interruptible(() (Ian Kent) [RHEL-143685] - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Ian Kent) [RHEL-143685] {CVE-2023-54134} - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141709] - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-136693] - audit: merge loops in __audit_inode_child() (Ricardo Robaina) [RHEL-140442] - bridge: mcast: Fix use-after-free during router port configuration (Mohammad Heib) [RHEL-138422] {CVE-2025-38248} - net/sched: Enforce that teql can only be used as root qdisc (CKI Backport Bot) [RHEL-146992] {CVE-2026-23074} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Marc Milgram) [RHEL-137838] {CVE-2025-38129} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143189] {CVE-2025-68800} - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126886] {CVE-2025-40064} - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - x86/microcode/AMD: Revert "Backport AMD microcode commits for better microcode loading support" (Waiman Long) [RHEL-155860] - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150398] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150398] - tcp: fix forever orphan socket caused by tcp_abort (Paolo Abeni) [RHEL-146187] - xfs: fix minimum agno handling for xfs alloc modes in RHEL8 (Brian Foster) [RHEL-102464] - xfs: fix uninitialized use of flags variable in xfs_alloc_vextent() (Brian Foster) [RHEL-102464] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82523] - tcp: use this_cpu_read(*X) instead of *this_cpu_ptr(X) (Davide Caratti) [RHEL-82523] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150221] - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150221] {CVE-2026-23209} - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) [RHEL-96016] - s390/kexec: Emit an error message when cmdline is too long (Mete Durlu) [RHEL-144946] - s390/boot: Fix kernel size in bootparm area (Mete Durlu) [RHEL-144946] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-137123] - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-151614] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove useless transaction in evict_linked_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-151614] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-151614] - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146419] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146419] {CVE-2025-38323} - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136288] - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136288] - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136288] - scsi: st: Tighten the page format heuristics with MODE SELECT (John Meneghini) [RHEL-136288] - scsi: st: ERASE does not change tape location (John Meneghini) [RHEL-136288] - scsi: st: Fix array overflow in st_setup() (John Meneghini) [RHEL-136288] - scsi: st: Add sysfs file position_lost_in_reset (John Meneghini) [RHEL-136288] - scsi: st: Modify st.c to use the new scsi_error counters (John Meneghini) [RHEL-136288] - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (John Meneghini) [RHEL-136288] - scsi: st: Restore some drive settings after reset (John Meneghini) [RHEL-136288] - scsi: st: Fix input/output error on empty drive reset (John Meneghini) [RHEL-136288] - smb: client: handle lack of IPC in dfs_cache_refresh() (Paulo Alcantara) [RHEL-138235] - smb: client: allow parsing zero-length AV pairs (Paulo Alcantara) [RHEL-138235] - cifs: reduce warning log level for server not advertising interfaces (Paulo Alcantara) [RHEL-138235] - smb: client: Fix match_session bug preventing session reuse (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of kstrdup() in get_ses_refpath() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy when tree connecting to DFS interlink targets (Paulo Alcantara) [RHEL-138235] - smb: client: don't trust DFSREF_STORAGE_SERVER bit (Paulo Alcantara) [RHEL-138235] - smb: client: don't check for @leaf_fullpath in match_server() (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of TCP_Server_Info::refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: don't retry DFS targets on server shutdown (Paulo Alcantara) [RHEL-138235] - smb: client: fix return value of parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: optimize referral walk on failed link targets (Paulo Alcantara) [RHEL-138235] - smb: client: provide dns_resolve_{unc,name} helpers (Paulo Alcantara) [RHEL-138235] - smb: client: parse DNS domain name from domain= option (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS mount against old servers with NTLMSSP (Paulo Alcantara) [RHEL-138235] - smb: client: parse av pair type 4 in CHALLENGE_MESSAGE (Paulo Alcantara) [RHEL-138235] - smb: client: introduce av_for_each_entry() helper (Paulo Alcantara) [RHEL-138235] - smb: client: fix double free of TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-138235] {CVE-2025-21673} - smb: client: fix potential race in cifs_put_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy message when mounting shares (Paulo Alcantara) [RHEL-138235] - smb: client: don't try following DFS links in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow reconnect when sending ioctl (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of @nlsc param in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow more DFS referrals to be cached (Paulo Alcantara) [RHEL-138235] - smb: client: propagate error from cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS failover in multiuser mounts (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS interlink failover (Paulo Alcantara) [RHEL-138235] - smb: client: improve purging of cached referrals (Paulo Alcantara) [RHEL-138235] - smb: client: avoid unnecessary reconnects when refreshing referrals (Paulo Alcantara) [RHEL-138235] - smb: client: serialise cifs_construct_tcon() with cifs_mount_mutex (Paulo Alcantara) [RHEL-138235] - smb: client: handle DFS tcons in cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: refresh referral without acquiring refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: guarantee refcounted children from parent session (Paulo Alcantara) [RHEL-138235] {CVE-2024-35869} - smb: client: set correct id, uid and cruid for multiuser automounts (Paulo Alcantara) [RHEL-138235] {CVE-2024-26822} - cifs: change tcon status when need_reconnect is set on it (Paulo Alcantara) [RHEL-138235] - smb: client: fix potential NULL deref in parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: fix mount when dns_resolver key is not available (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs code dep in namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs naming in automount code (Paulo Alcantara) [RHEL-138235] - smb: client: rename cifs_dfs_ref.c to namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: ensure to try all targets when finding nested links (Paulo Alcantara) [RHEL-138235] - smb: client: introduce DFS_CACHE_TGT_LIST() (Paulo Alcantara) [RHEL-138235] - smb: client: fix null auth (Paulo Alcantara) [RHEL-138235] - smb: client: fix dfs link mount against w2k8 (Paulo Alcantara) [RHEL-138235] - cifs: fix charset issue in reconnection (Paulo Alcantara) [RHEL-138235] - smb: client: fix missed ses refcounting (Paulo Alcantara) [RHEL-138235] {CVE-2023-54076} - fs/nls: make load_nls() take a const parameter (Paulo Alcantara) [RHEL-138235] - smb: client: remove redundant pointer 'server' (Paulo Alcantara) [RHEL-138235] - smb: client: improve DFS mount check (Paulo Alcantara) [RHEL-138235] - smb: client: fix shared DFS root mounts with different prefixes (Paulo Alcantara) [RHEL-138235] - smb: client: fix parsing of source mount option (Paulo Alcantara) [RHEL-138235] - smb: client: fix warning in cifs_match_super() (Paulo Alcantara) [RHEL-138235] - cifs: fix max_credits implementation (Paulo Alcantara) [RHEL-138235] - cifs: fix sockaddr comparison in iface_cmp (Paulo Alcantara) [RHEL-138235] - cifs: fix status checks in cifs_tree_connect (Paulo Alcantara) [RHEL-138235] - cifs: fix smb1 mount regression (Paulo Alcantara) [RHEL-138235] - cifs: fix sharing of DFS connections (Paulo Alcantara) [RHEL-138235] - cifs: avoid potential races when handling multiple dfs tcons (Paulo Alcantara) [RHEL-138235] - cifs: protect access of TCP_Server_Info::{origin,leaf}_fullpath (Paulo Alcantara) [RHEL-138235] - cifs: avoid dup prefix path in dfs_get_automount_devname() (Paulo Alcantara) [RHEL-138235] - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL (Paulo Alcantara) [RHEL-138235] {CVE-2023-53246} - smb3: fix unusable share after force unmount failure (Paulo Alcantara) [RHEL-138235] - cifs: check only tcon status on tcon related functions (Paulo Alcantara) [RHEL-138235] - cifs: return DFS root session id in DebugData (Paulo Alcantara) [RHEL-138235] - cifs: fix use-after-free bug in refresh_cache_worker() (Paulo Alcantara) [RHEL-138235] {CVE-2023-53052} - cifs: set DFS root session in cifs_get_smb_ses() (Paulo Alcantara) [RHEL-138235] - cifs: remove unused function (Paulo Alcantara) [RHEL-138235] - cifs: remove duplicate code in __refresh_tcon() (Paulo Alcantara) [RHEL-138235] - cifs: remove redundant assignment to the variable match (Paulo Alcantara) [RHEL-138235] - cifs: use origin fullpath for automounts (Paulo Alcantara) [RHEL-138235] - cifs: fix source pathname comparison of dfs supers (Paulo Alcantara) [RHEL-138235] - cifs: fix confusing debug message (Paulo Alcantara) [RHEL-138235] - cifs: don't block in dfs_cache_noreq_update_tgthint() (Paulo Alcantara) [RHEL-138235] - cifs: refresh root referrals (Paulo Alcantara) [RHEL-138235] - cifs: fix refresh of cached referrals (Paulo Alcantara) [RHEL-138235] - cifs: share dfs connections and supers (Paulo Alcantara) [RHEL-138235] - cifs: split out ses and tcon retrieval from mount_get_conns() (Paulo Alcantara) [RHEL-138235] - cifs: set resolved ip in sockaddr (Paulo Alcantara) [RHEL-138235] - cifs: remove unused smb3_fs_context::mount_options (Paulo Alcantara) [RHEL-138235] - cifs: get rid of mount options string parsing (Paulo Alcantara) [RHEL-138235] - cifs: use fs_context for automounts (Paulo Alcantara) [RHEL-138235] - cifs: remove various function description warnings (Paulo Alcantara) [RHEL-138235] - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Select which microcode patch to load (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add more known models to entry sign checking (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Limit Entrysign signature checking to known generations (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use sha256() instead of init/update/final (Waiman Long) [RHEL-132479] - x86/microcode: Fix Entrysign revision check for Zen1/Naples (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Handle the case of no BIOS microcode (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add some forgotten models to the SHA check (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Load only SHA256-checksummed patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add get_patch_level() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Merge early_apply_microcode() into its single callsite (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Have __apply_microcode_amd() return bool (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Flush patch buffer mapping after application (Waiman Long) [RHEL-132479] - x86/mm: Carve out INVLPG inline asm for use by others (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Split load_microcode_amd() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Pay attention to the stepping dynamically (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix a -Wsometimes-uninitialized clang false positive (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use the family,model,stepping encoded in the patch ID (Waiman Long) [RHEL-132479] - x86/microcode/amd: Cache builtin microcode too (Waiman Long) [RHEL-132479] - x86/microcode/amd: Use correct per CPU ucode_cpu_info (Waiman Long) [RHEL-132479] - x86/microcode/amd: Remove X86_32 specific code in early_apply_microcode() & get_builtin_microcode() (Waiman Long) [RHEL-132479] - x86/microcode: Move core specific defines to local header (Waiman Long) [RHEL-132479] - x86/microcode/intel: Rename get_datasize() since its used externally (Waiman Long) [RHEL-132479] - x86/microcode: Make reload_early_microcode() static (Waiman Long) [RHEL-132479] - x86/microcode: Include vendor headers into microcode.h (Waiman Long) [RHEL-132479] - x86/microcode/intel: Move microcode functions out of cpu/intel.c (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Get rid of __find_equiv_id() (Waiman Long) [RHEL-132479] - x86/microcode: Add explicit CPU vendor dependency (Waiman Long) [RHEL-132479] - macvlan: fix possible UAF in macvlan_forward_source() (Hangbin Liu) [RHEL-144120] {CVE-2026-23001} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-131922] - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount (Jocelyn Falempe) [RHEL-148636] - audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd references (Waiman Long) [RHEL-146026] - fs: Add a pool of extra fs->pwd references to fs_struct (Waiman Long) [RHEL-146026] - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143535] {CVE-2025-71085} - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147261] {CVE-2026-23097} - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-134673] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930] - NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242] - pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242] - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242] - NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242] - NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242] - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242] - SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242] - NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242] - SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242] - SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242] - SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242] - SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242] - NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242] - NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419] - nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419] - pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419] - NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419] - NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419] - NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419] - NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419] - NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419] - NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419] - NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419] - NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419] - NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419] - nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419] - nfs: always check dreq->error after a commit (Mike Snitzer) [RHEL-156419] - nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419] - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231} - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942] - x86/microcode/AMD: Revert "Backport AMD microcode commits for better microcode loading support" (Waiman Long) [RHEL-155860] - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150398] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150398] - tcp: fix forever orphan socket caused by tcp_abort (Paolo Abeni) [RHEL-146187] - xfs: fix minimum agno handling for xfs alloc modes in RHEL8 (Brian Foster) [RHEL-102464] - xfs: fix uninitialized use of flags variable in xfs_alloc_vextent() (Brian Foster) [RHEL-102464] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82523] - tcp: use this_cpu_read(*X) instead of *this_cpu_ptr(X) (Davide Caratti) [RHEL-82523] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150221] - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150221] {CVE-2026-23209} - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) [RHEL-96016] - s390/kexec: Emit an error message when cmdline is too long (Mete Durlu) [RHEL-144946] - s390/boot: Fix kernel size in bootparm area (Mete Durlu) [RHEL-144946] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-137123] - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-151614] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove useless transaction in evict_linked_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-151614] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-151614] - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146419] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146419] {CVE-2025-38323} - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136288] - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136288] - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136288] - scsi: st: Tighten the page format heuristics with MODE SELECT (John Meneghini) [RHEL-136288] - scsi: st: ERASE does not change tape location (John Meneghini) [RHEL-136288] - scsi: st: Fix array overflow in st_setup() (John Meneghini) [RHEL-136288] - scsi: st: Add sysfs file position_lost_in_reset (John Meneghini) [RHEL-136288] - scsi: st: Modify st.c to use the new scsi_error counters (John Meneghini) [RHEL-136288] - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (John Meneghini) [RHEL-136288] - scsi: st: Restore some drive settings after reset (John Meneghini) [RHEL-136288] - scsi: st: Fix input/output error on empty drive reset (John Meneghini) [RHEL-136288] - smb: client: handle lack of IPC in dfs_cache_refresh() (Paulo Alcantara) [RHEL-138235] - smb: client: allow parsing zero-length AV pairs (Paulo Alcantara) [RHEL-138235] - cifs: reduce warning log level for server not advertising interfaces (Paulo Alcantara) [RHEL-138235] - smb: client: Fix match_session bug preventing session reuse (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of kstrdup() in get_ses_refpath() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy when tree connecting to DFS interlink targets (Paulo Alcantara) [RHEL-138235] - smb: client: don't trust DFSREF_STORAGE_SERVER bit (Paulo Alcantara) [RHEL-138235] - smb: client: don't check for @leaf_fullpath in match_server() (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of TCP_Server_Info::refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: don't retry DFS targets on server shutdown (Paulo Alcantara) [RHEL-138235] - smb: client: fix return value of parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: optimize referral walk on failed link targets (Paulo Alcantara) [RHEL-138235] - smb: client: provide dns_resolve_{unc,name} helpers (Paulo Alcantara) [RHEL-138235] - smb: client: parse DNS domain name from domain= option (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS mount against old servers with NTLMSSP (Paulo Alcantara) [RHEL-138235] - smb: client: parse av pair type 4 in CHALLENGE_MESSAGE (Paulo Alcantara) [RHEL-138235] - smb: client: introduce av_for_each_entry() helper (Paulo Alcantara) [RHEL-138235] - smb: client: fix double free of TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-138235] {CVE-2025-21673} - smb: client: fix potential race in cifs_put_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy message when mounting shares (Paulo Alcantara) [RHEL-138235] - smb: client: don't try following DFS links in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow reconnect when sending ioctl (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of @nlsc param in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow more DFS referrals to be cached (Paulo Alcantara) [RHEL-138235] - smb: client: propagate error from cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS failover in multiuser mounts (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS interlink failover (Paulo Alcantara) [RHEL-138235] - smb: client: improve purging of cached referrals (Paulo Alcantara) [RHEL-138235] - smb: client: avoid unnecessary reconnects when refreshing referrals (Paulo Alcantara) [RHEL-138235] - smb: client: serialise cifs_construct_tcon() with cifs_mount_mutex (Paulo Alcantara) [RHEL-138235] - smb: client: handle DFS tcons in cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: refresh referral without acquiring refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: guarantee refcounted children from parent session (Paulo Alcantara) [RHEL-138235] {CVE-2024-35869} - smb: client: set correct id, uid and cruid for multiuser automounts (Paulo Alcantara) [RHEL-138235] {CVE-2024-26822} - cifs: change tcon status when need_reconnect is set on it (Paulo Alcantara) [RHEL-138235] - smb: client: fix potential NULL deref in parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: fix mount when dns_resolver key is not available (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs code dep in namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs naming in automount code (Paulo Alcantara) [RHEL-138235] - smb: client: rename cifs_dfs_ref.c to namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: ensure to try all targets when finding nested links (Paulo Alcantara) [RHEL-138235] - smb: client: introduce DFS_CACHE_TGT_LIST() (Paulo Alcantara) [RHEL-138235] - smb: client: fix null auth (Paulo Alcantara) [RHEL-138235] - smb: client: fix dfs link mount against w2k8 (Paulo Alcantara) [RHEL-138235] - cifs: fix charset issue in reconnection (Paulo Alcantara) [RHEL-138235] - smb: client: fix missed ses refcounting (Paulo Alcantara) [RHEL-138235] {CVE-2023-54076} - fs/nls: make load_nls() take a const parameter (Paulo Alcantara) [RHEL-138235] - smb: client: remove redundant pointer 'server' (Paulo Alcantara) [RHEL-138235] - smb: client: improve DFS mount check (Paulo Alcantara) [RHEL-138235] - smb: client: fix shared DFS root mounts with different prefixes (Paulo Alcantara) [RHEL-138235] - smb: client: fix parsing of source mount option (Paulo Alcantara) [RHEL-138235] - smb: client: fix warning in cifs_match_super() (Paulo Alcantara) [RHEL-138235] - cifs: fix max_credits implementation (Paulo Alcantara) [RHEL-138235] - cifs: fix sockaddr comparison in iface_cmp (Paulo Alcantara) [RHEL-138235] - cifs: fix status checks in cifs_tree_connect (Paulo Alcantara) [RHEL-138235] - cifs: fix smb1 mount regression (Paulo Alcantara) [RHEL-138235] - cifs: fix sharing of DFS connections (Paulo Alcantara) [RHEL-138235] - cifs: avoid potential races when handling multiple dfs tcons (Paulo Alcantara) [RHEL-138235] - cifs: protect access of TCP_Server_Info::{origin,leaf}_fullpath (Paulo Alcantara) [RHEL-138235] - cifs: avoid dup prefix path in dfs_get_automount_devname() (Paulo Alcantara) [RHEL-138235] - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL (Paulo Alcantara) [RHEL-138235] {CVE-2023-53246} - smb3: fix unusable share after force unmount failure (Paulo Alcantara) [RHEL-138235] - cifs: check only tcon status on tcon related functions (Paulo Alcantara) [RHEL-138235] - cifs: return DFS root session id in DebugData (Paulo Alcantara) [RHEL-138235] - cifs: fix use-after-free bug in refresh_cache_worker() (Paulo Alcantara) [RHEL-138235] {CVE-2023-53052} - cifs: set DFS root session in cifs_get_smb_ses() (Paulo Alcantara) [RHEL-138235] - cifs: remove unused function (Paulo Alcantara) [RHEL-138235] - cifs: remove duplicate code in __refresh_tcon() (Paulo Alcantara) [RHEL-138235] - cifs: remove redundant assignment to the variable match (Paulo Alcantara) [RHEL-138235] - cifs: use origin fullpath for automounts (Paulo Alcantara) [RHEL-138235] - cifs: fix source pathname comparison of dfs supers (Paulo Alcantara) [RHEL-138235] - cifs: fix confusing debug message (Paulo Alcantara) [RHEL-138235] - cifs: don't block in dfs_cache_noreq_update_tgthint() (Paulo Alcantara) [RHEL-138235] - cifs: refresh root referrals (Paulo Alcantara) [RHEL-138235] - cifs: fix refresh of cached referrals (Paulo Alcantara) [RHEL-138235] - cifs: share dfs connections and supers (Paulo Alcantara) [RHEL-138235] - cifs: split out ses and tcon retrieval from mount_get_conns() (Paulo Alcantara) [RHEL-138235] - cifs: set resolved ip in sockaddr (Paulo Alcantara) [RHEL-138235] - cifs: remove unused smb3_fs_context::mount_options (Paulo Alcantara) [RHEL-138235] - cifs: get rid of mount options string parsing (Paulo Alcantara) [RHEL-138235] - cifs: use fs_context for automounts (Paulo Alcantara) [RHEL-138235] - cifs: remove various function description warnings (Paulo Alcantara) [RHEL-138235] - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Select which microcode patch to load (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add more known models to entry sign checking (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Limit Entrysign signature checking to known generations (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use sha256() instead of init/update/final (Waiman Long) [RHEL-132479] - x86/microcode: Fix Entrysign revision check for Zen1/Naples (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Handle the case of no BIOS microcode (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add some forgotten models to the SHA check (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Load only SHA256-checksummed patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add get_patch_level() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Merge early_apply_microcode() into its single callsite (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Have __apply_microcode_amd() return bool (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Flush patch buffer mapping after application (Waiman Long) [RHEL-132479] - x86/mm: Carve out INVLPG inline asm for use by others (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Split load_microcode_amd() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Pay attention to the stepping dynamically (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix a -Wsometimes-uninitialized clang false positive (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use the family,model,stepping encoded in the patch ID (Waiman Long) [RHEL-132479] - x86/microcode/amd: Cache builtin microcode too (Waiman Long) [RHEL-132479] - x86/microcode/amd: Use correct per CPU ucode_cpu_info (Waiman Long) [RHEL-132479] - x86/microcode/amd: Remove X86_32 specific code in early_apply_microcode() & get_builtin_microcode() (Waiman Long) [RHEL-132479] - x86/microcode: Move core specific defines to local header (Waiman Long) [RHEL-132479] - x86/microcode/intel: Rename get_datasize() since its used externally (Waiman Long) [RHEL-132479] - x86/microcode: Make reload_early_microcode() static (Waiman Long) [RHEL-132479] - x86/microcode: Include vendor headers into microcode.h (Waiman Long) [RHEL-132479] - x86/microcode/intel: Move microcode functions out of cpu/intel.c (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Get rid of __find_equiv_id() (Waiman Long) [RHEL-132479] - x86/microcode: Add explicit CPU vendor dependency (Waiman Long) [RHEL-132479] - macvlan: fix possible UAF in macvlan_forward_source() (Hangbin Liu) [RHEL-144120] {CVE-2026-23001} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-131922] - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount (Jocelyn Falempe) [RHEL-148636] - audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd references (Waiman Long) [RHEL-146026] - fs: Add a pool of extra fs->pwd references to fs_struct (Waiman Long) [RHEL-146026] - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143535] {CVE-2025-71085} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930] - NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242] - pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242] - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242] - NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242] - NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242] - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242] - SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242] - NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242] - SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242] - SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242] - SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242] - SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242] - NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242] - NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419] - nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419] - pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419] - NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419] - NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419] - NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419] - NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419] - NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419] - NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419] - NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419] - NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419] - NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419] - nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419] - nfs: always check dreq->error after a commit (Mike Snitzer) [RHEL-156419] - nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419] - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231} - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942] - x86/microcode/AMD: Revert "Backport AMD microcode commits for better microcode loading support" (Waiman Long) [RHEL-155860] - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150398] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150398] - tcp: fix forever orphan socket caused by tcp_abort (Paolo Abeni) [RHEL-146187] - xfs: fix minimum agno handling for xfs alloc modes in RHEL8 (Brian Foster) [RHEL-102464] - xfs: fix uninitialized use of flags variable in xfs_alloc_vextent() (Brian Foster) [RHEL-102464] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82523] - tcp: use this_cpu_read(*X) instead of *this_cpu_ptr(X) (Davide Caratti) [RHEL-82523] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150221] - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150221] {CVE-2026-23209} - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) [RHEL-96016] - s390/kexec: Emit an error message when cmdline is too long (Mete Durlu) [RHEL-144946] - s390/boot: Fix kernel size in bootparm area (Mete Durlu) [RHEL-144946] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-137123] - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-151614] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove useless transaction in evict_linked_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-151614] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-151614] - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146419] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146419] {CVE-2025-38323} - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136288] - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136288] - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136288] - scsi: st: Tighten the page format heuristics with MODE SELECT (John Meneghini) [RHEL-136288] - scsi: st: ERASE does not change tape location (John Meneghini) [RHEL-136288] - scsi: st: Fix array overflow in st_setup() (John Meneghini) [RHEL-136288] - scsi: st: Add sysfs file position_lost_in_reset (John Meneghini) [RHEL-136288] - scsi: st: Modify st.c to use the new scsi_error counters (John Meneghini) [RHEL-136288] - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (John Meneghini) [RHEL-136288] - scsi: st: Restore some drive settings after reset (John Meneghini) [RHEL-136288] - scsi: st: Fix input/output error on empty drive reset (John Meneghini) [RHEL-136288] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930] - NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242] - pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242] - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242] - NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242] - NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242] - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242] - SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242] - NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242] - SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242] - SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242] - SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242] - SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242] - NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242] - NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419] - nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419] - pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419] - NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419] - NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419] - NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419] - NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419] - NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419] - NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419] - NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419] - NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419] - NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419] - nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419] - nfs: always check dreq->error after a commit (Mike Snitzer) [RHEL-156419] - nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419] - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231} - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942] - xfrm: esp: avoid in-place decrypt on shared skb frags - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772] - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772] - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772] - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772] - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772] - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772] - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709} - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815] - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815] - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815] - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190} - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408} - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684} - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032] - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032] - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032] - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032] - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032] - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032] - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032] - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032] - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032] - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183} - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219] - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219] - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219] - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219] - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219] - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219] - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219] - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347} - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243} - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890] - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890] - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890] - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890] - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890] - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890] - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890] - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613} - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961] - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858} - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392} - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781} - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990} - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772] - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772] - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772] - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772] - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772] - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772] - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709} - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815] - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815] - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815] - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190} - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408} - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684} - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032] - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032] - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032] - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032] - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032] - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032] - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032] - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032] - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032] - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183} - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219] - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219] - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219] - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219] - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219] - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219] - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219] - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347} - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243} - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890] - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890] - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890] - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890] - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890] - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890] - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890] - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613} - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961] - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858} - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392} - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781} - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990} - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772] - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772] - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772] - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772] - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772] - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772] - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709} - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815] - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815] - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815] - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190} - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408} - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684} - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032] - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032] - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032] - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032] - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032] - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032] - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032] - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032] - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032] - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183} - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219] - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219] - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219] - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219] - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219] - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219] - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219] - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347} - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243} - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890] - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890] - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890] - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890] - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890] - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890] - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890] - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613} - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961] - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858} - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392} - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781} - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - [rt] build kernel-rt-4.18.0-553.16.1.rt7.357.el8_10 [RHEL-44553] - x86/bhi: Fix incorrect CLEAR_BRANCH_HISTORY position in entry_INT80_compat (Waiman Long) [RHEL-50648] - [rt] build kernel-rt-4.18.0-553.15.1.rt7.356.el8_10 [RHEL-44553] - Revert "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-44613] - ionic: fix use after netif_napi_del() (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - ionic: clean interrupt before enabling queue to avoid credit race (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change (CKI Backport Bot) [RHEL-49321] {CVE-2021-47624} - xhci: Handle TD clearing for multiple streams case (CKI Backport Bot) [RHEL-47882] {CVE-2024-40927} - net: openvswitch: Fix Use-After-Free in ovs_ct_exit (cki-backport-bot) [RHEL-36362] {CVE-2024-27395} - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: fix vlan use-after-free (cki-backport-bot) [RHEL-43721] {CVE-2024-36979} - irqchip/gic-v3-its: Prevent double free on error (Charles Mirabile) [RHEL-37022] {CVE-2024-35847} - irqchip/gic-v3-its: Fix potential VPE leak on error (Charles Mirabile) [RHEL-37744] {CVE-2021-47373} - i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() (Charles Mirabile) [RHEL-34735] {CVE-2022-48632} - iommu/dma: fix zeroing of bounce buffer padding used by untrusted devices (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: remove alloc_size argument to swiotlb_tbl_map_single() (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: fix swiotlb_bounce() to do partial sync's correctly (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Reinstate page-alignment for mappings >= PAGE_SIZE (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix alignment checks when both allocation and DMA masks are present (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix double-allocation of slots due to broken alignment handling (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (cki-backport-bot) [RHEL-44441] {CVE-2024-31076} - [rt] build kernel-rt-4.18.0-553.14.1.rt7.355.el8_10 [RHEL-44553] - s390/qeth: Fix kernel panic after setting hsuid (Mete Durlu) [RHEL-49754] - perf/core: Protect event sibling list locking against interrupt inversion (Daniel Vacek) [RHEL-31798] - vt: fix unicode buffer corruption when deleting characters (Steve Best) [RHEL-36936] {CVE-2024-35823} - cifs: translate network errors on send to -ECONNABORTED (Paulo Alcantara) [RHEL-36754] - xfs: don't block in busy flushing when freeing extents (Brian Foster) [RHEL-7984] - xfs: allow extent free intents to be retried (Brian Foster) [RHEL-7984] - xfs: pass alloc flags through to xfs_extent_busy_flush() (Brian Foster) [RHEL-7984] - xfs: use deferred frees for btree block freeing (Brian Foster) [RHEL-7984] - xfs: fix bounds check in xfs_defer_agfl_block() (Brian Foster) [RHEL-7984] - xfs: validate block number being freed before adding to xefi (Brian Foster) [RHEL-7984] - xfs: rename xfs_bmap_add_free to xfs_free_extent_later (Brian Foster) [RHEL-7984] - usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (Desnes Nunes) [RHEL-36803] {CVE-2024-35790} - stm class: Fix a double free in stm_register_device() (Steve Best) [RHEL-44514] {CVE-2024-38627} - s390/qeth: Fix potential loss of L3-IP@ in case of network issues (Mete Durlu) [RHEL-49755] - tls: fix missing memory barrier in tls_init (cki-backport-bot) [RHEL-44471] {CVE-2024-36489} - xfs: fix log recovery buffer allocation for the legacy h_size fixup (Bill O'Donnell) [RHEL-46473] {CVE-2024-39472} - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: use __for_each_thread() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - exit: Use the correct exit_code in /proc/<pid>/stat (Brian Foster) [RHEL-31562] {CVE-2024-26686} - scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool (Ewan D. Milne) [RHEL-38283] {CVE-2023-52811} - scsi: qla2xxx: Fix double free of fcport (Ewan D. Milne) [RHEL-39549] {CVE-2024-26929} - scsi: qla2xxx: Fix double free of the ha->vp_map pointer (Ewan D. Milne) [RHEL-39549] {CVE-2024-26930} - scsi: qla2xxx: Fix command flush on cable pull (Ewan D. Milne) [RHEL-39549] {CVE-2024-26931} - [rt] build kernel-rt-4.18.0-553.13.1.rt7.354.el8_10 [RHEL-44553] - redhat: remove handling of deleted rhdocs/ directory from genspec.sh (Denys Vlasenko) - x86/bugs: Fix BHI retpoline check (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI handling of RRSBA (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr' (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI documentation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix return type of spectre_bhi_state() (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Make CONFIG_SPECTRE_BHI_ON the default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Mitigate KVM by default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add BHI mitigation knob (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Enumerate Branch History Injection (BHI) bug (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Define SPEC_CTRL_BHI_DIS_S (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add support for clearing branch history at syscall entry (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file (Waiman Long) [RHEL-28202] - perf/x86/amd/lbr: Use freeze based on availability (Waiman Long) [RHEL-28202] - Documentation/kernel-parameters: Add spec_rstack_overflow to mitigations=off (Waiman Long) [RHEL-28202] - KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace (Waiman Long) [RHEL-28202] - x86/bugs: Reset speculation control settings on init (Waiman Long) [RHEL-28202] - KVM: x86: Update KVM-only leaf handling to allow for 100% KVM-only leafs (Waiman Long) [RHEL-28202] - KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest (Waiman Long) [RHEL-28202] - mptcp: ensure snd_nxt is properly initialized on connect (Davide Caratti) [RHEL-39865] {CVE-2024-36889} - powerpc/pseries: Enforce hcall result buffer validity and size (Mamatha Inamdar) [RHEL-48291] {CVE-2024-40974} - wifi: mac80211: fix potential key use-after-free (Jose Ignacio Tornos Martinez) [RHEL-28007] {CVE-2023-52530} - cppc_cpufreq: Fix possible null pointer dereference (Mark Langsdorf) [RHEL-44137] {CVE-2024-38573} - net/sched: act_mirred: use the backlog for mirred ingress (Davide Caratti) [RHEL-31718] {CVE-2024-26740} - vfio/pci: Lock external INTx masking ops (Alex Williamson) [RHEL-31922] {CVE-2024-26810} - net: sched: sch_multiq: fix possible OOB write in multiq_tune() (Davide Caratti) [RHEL-43464] {CVE-2024-36978} - tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized (Guillaume Nault) [RHEL-37850] {CVE-2021-47304} - pstore/ram: Fix crash when setting number of cpus to an odd number (Lenny Szubowicz) [RHEL-29471] {CVE-2023-52619} - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node (Jocelyn Falempe) [RHEL-37101] {CVE-2023-52662} - drm/vmwgfx: Fix the lifetime of the bo cursor memory (Jocelyn Falempe) [RHEL-36962] {CVE-2024-35810} - drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed (Jocelyn Falempe) [RHEL-34987] {CVE-2024-26940} - drm/vmwgfx: Unmap the surface before resetting it on a plane state (Jocelyn Falempe) [RHEL-35217] {CVE-2023-52648} - drm/vmwgfx: Fix invalid reads in fence signaled events (Jocelyn Falempe) [RHEL-40010] {CVE-2024-36960} - block: Fix wrong offset in bio_truncate() (Ming Lei) [RHEL-43782] {CVE-2022-48747} - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CKI Backport Bot) [RHEL-46913] {CVE-2024-39487} - net: fix __dst_negative_advice() race (Xin Long) [RHEL-41183] {CVE-2024-36971} - igc: avoid returning frame twice in XDP_REDIRECT (Corinna Vinschen) [RHEL-33264] {CVE-2024-26853} - mac802154: fix llsec key resources release in mac802154_llsec_key_del (Steve Best) [RHEL-34967] {CVE-2024-26961} - cpufreq: exit() callback is optional (Mark Langsdorf) [RHEL-43840] {CVE-2024-38615} - cifs: prevent infinite recursion in CIFSGetDFSRefer() (Paulo Alcantara) [RHEL-34672] - cifs: lock chan_lock outside match_session (Paulo Alcantara) [RHEL-34672] - smb3: workaround negprot bug in some Samba servers (Paulo Alcantara) [RHEL-34672] - smb3: use netname when available on secondary channels (Paulo Alcantara) [RHEL-34672] - smb3: fix empty netname context on secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: populate empty hostnames for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: always iterate smb sessions using primary channel (Paulo Alcantara) [RHEL-34672] - cifs: Fix connections leak when tlink setup failed (Paulo Alcantara) [RHEL-34672] - cifs: Fix memory leak when build ntlmssp negotiate blob failed (Paulo Alcantara) [RHEL-34672] - cifs: always initialize struct msghdr smb_msg completely (Paulo Alcantara) [RHEL-34672] - cifs: don't send down the destination address to sendmsg for a SOCK_STREAM (Paulo Alcantara) [RHEL-34672] - cifs: revalidate mapping when doing direct writes (Paulo Alcantara) [RHEL-34672] - cifs: skip extra NULL byte in filenames (Paulo Alcantara) [RHEL-34672] - cifs: list_for_each() -> list_for_each_entry() (Paulo Alcantara) [RHEL-34672] - smb2: small refactor in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - cifs: Fix crash on unload of cifs_arc4.ko (Paulo Alcantara) [RHEL-34672] - cifs: remove check of list iterator against head past the loop body (Paulo Alcantara) [RHEL-34672] - cifs: fix reconnect on smb3 mount types (Paulo Alcantara) [RHEL-34672] - cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (Paulo Alcantara) [RHEL-34672] - cifs: skip trailing separators of prefix paths (Paulo Alcantara) [RHEL-34672] - cifs: fix ntlmssp on old servers (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL ptr dereference in refresh_mounts() (Paulo Alcantara) [RHEL-34672] - cifs: do not skip link targets when an I/O fails (Paulo Alcantara) [RHEL-34672] - cifs: fix confusing unneeded warning message on smb2.1 and earlier (Paulo Alcantara) [RHEL-34672] - smb3: fix snapshot mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix workstation_name for multiuser mounts (Paulo Alcantara) [RHEL-34672] - cifs: alloc_path_with_tree_prefix: do not append sep. if the path is empty (Paulo Alcantara) [RHEL-34672] - cifs: free ntlmsspblob allocated in negotiate (Paulo Alcantara) [RHEL-34672] - cifs: avoid use of dstaddr as key for fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: add server conn_id to fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: fix missed refcounting of ipc tcon (Paulo Alcantara) [RHEL-34672] - smb2: clarify rc initialization in smb2_reconnect (Paulo Alcantara) [RHEL-34672] - cifs: populate server_hostname for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should be set on new server (Paulo Alcantara) [RHEL-34672] - cifs: introduce cifs_ses_mark_for_reconnect() helper (Paulo Alcantara) [RHEL-34672] - cifs: protect srv_count with cifs_tcp_ses_lock (Paulo Alcantara) [RHEL-34672] - cifs: move debug print out of spinlock (Paulo Alcantara) [RHEL-34672] - cifs: do not duplicate fscache cookie for secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: connect individual channel servers to primary channel server (Paulo Alcantara) [RHEL-34672] - cifs: protect session channel fields with chan_lock (Paulo Alcantara) [RHEL-34672] - cifs: do not negotiate session if session already exists (Paulo Alcantara) [RHEL-34672] - smb3: do not setup the fscache_super_cookie until fsinfo initialized (Paulo Alcantara) [RHEL-34672] - cifs: fix potential use-after-free bugs (Paulo Alcantara) [RHEL-34672] - cifs: release lock earlier in dequeue_mid error case (Paulo Alcantara) [RHEL-34672] - smb3: remove trivial dfs compile warning (Paulo Alcantara) [RHEL-34672] - cifs: support nested dfs links over reconnect (Paulo Alcantara) [RHEL-34672] - cifs: for compound requests, use open handle if possible (Paulo Alcantara) [RHEL-34672] - cifs: split out dfs code from cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant (Paulo Alcantara) [RHEL-34672] - cifs: introduce new helper for cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: fix print of hdr_flags in dfscache_proc_show() (Paulo Alcantara) [RHEL-34672] - cifs: send workstation name during ntlmssp session setup (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should not share socket with future sessions (Paulo Alcantara) [RHEL-34672] - smb3: add dynamic trace points for socket connection (Paulo Alcantara) [RHEL-34672] - cifs: Move SMB2_Create definitions to the shared area (Paulo Alcantara) [RHEL-34672] - cifs: Move more definitions into the shared area (Paulo Alcantara) [RHEL-34672] - cifs: move NEGOTIATE_PROTOCOL definitions out into the common area (Paulo Alcantara) [RHEL-34672] - cifs: Create a new shared file holding smb2 pdu definitions (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect check for null pointer in header_assemble (Paulo Alcantara) [RHEL-34672] - smb3: correct server pointer dereferencing check to be more consistent (Paulo Alcantara) [RHEL-34672] - cifs: Deal with some warnings from W=1 (Paulo Alcantara) [RHEL-34672] - cifs: fix a sign extension bug (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect kernel doc comments (Paulo Alcantara) [RHEL-34672] - cifs: remove pathname for file from SPDX header (Paulo Alcantara) [RHEL-34672] - cifs: move SMB FSCTL definitions to common code (Paulo Alcantara) [RHEL-34672] - cifs: rename cifs_common to smbfs_common (Paulo Alcantara) [RHEL-34672] - cifs: update FSCTL definitions (Paulo Alcantara) [RHEL-34672] - cifs: cifs_md4 convert to SPDX identifier (Paulo Alcantara) [RHEL-34672] - cifs: create a MD4 module and switch cifs.ko to use it (Paulo Alcantara) [RHEL-34672] - cifs: fork arc4 and create a separate module for it for cifs and other users (Paulo Alcantara) [RHEL-34672] - smb3: fix posix extensions mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix wrong release in sess_alloc_buffer() failed path (Paulo Alcantara) [RHEL-34672] - CIFS: Fix a potencially linear read overflow (Paulo Alcantara) [RHEL-34672] - cifs: use the correct max-length for dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: create sd context must be a multiple of 8 (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp sessions of dfs connections (Paulo Alcantara) [RHEL-34672] - cifs: added WARN_ON for all the count decrements (Paulo Alcantara) [RHEL-34672] - cifs: fix missing null session check in mount (Paulo Alcantara) [RHEL-34672] - cifs: handle reconnect of tcon when there is no cached dfs referral (Paulo Alcantara) [RHEL-34672] - cifs: fix the out of range assignment to bit fields in parse_server_interfaces (Paulo Alcantara) [RHEL-34672] - smb3: fix typo in header file (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: Add support for negotiating signing algorithm (Paulo Alcantara) [RHEL-34672] - cifs: prevent NULL deref in cifs_compose_mount_options() (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL dereference in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - smbdirect: missing rc checks while waiting for rdma events (Paulo Alcantara) [RHEL-34672] - cifs: Avoid field over-reading memcpy() (Paulo Alcantara) [RHEL-34672] - smb311: remove dead code for non compounded posix query info (Paulo Alcantara) [RHEL-34672] - cifs: fix SMB1 error path in cifs_get_file_info_unix (Paulo Alcantara) [RHEL-34672] - smb3: fix uninitialized value for port in witness protocol move (Paulo Alcantara) [RHEL-34672] - cifs: fix unneeded null check (Paulo Alcantara) [RHEL-34672] - cifs: use SPDX-Licence-Identifier (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in cifs_debug.c (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in smb2misc.c (Paulo Alcantara) [RHEL-34672] - cifs: missed ref-counting smb session in find (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp servers with dfs mounts (Paulo Alcantara) [RHEL-34672] - cifs: set a minimum of 2 minutes for refreshing dfs cache (Paulo Alcantara) [RHEL-34672] - cifs: Remove unused inline function is_sysvol_or_netlogon() (Paulo Alcantara) [RHEL-34672] - cifs: remove duplicated prototype (Paulo Alcantara) [RHEL-34672] - cifs: fix ipv6 formating in cifs_ses_add_channel (Paulo Alcantara) [RHEL-34672] - cifs: fix string declarations and assignments in tracepoints (Paulo Alcantara) [RHEL-34672] - cifs: fix memory leak in smb2_copychunk_range (Paulo Alcantara) [RHEL-34672] - SMB3: incorrect file id in requests compounded with open (Paulo Alcantara) [RHEL-34672] - smb3: if max_channels set to more than one channel request multichannel (Paulo Alcantara) [RHEL-34672] - smb3: do not attempt multichannel to server which does not support it (Paulo Alcantara) [RHEL-34672] - smb3: when mounting with multichannel include it in requested capabilities (Paulo Alcantara) [RHEL-34672] - cifs: simplify SWN code with dummy funcs instead of ifdefs (Paulo Alcantara) [RHEL-34672] - cifs: log mount errors using cifs_errorf() (Paulo Alcantara) [RHEL-34672] - cifs: switch build_path_from_dentry() to using dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: fix out-of-bound memory access when calling smb3_notify() at mount point (Paulo Alcantara) [RHEL-34672] - cifs: allocate buffer in the caller of build_path_from_dentry() (Paulo Alcantara) [RHEL-34672] - cifs: make build_path_from_dentry() return const char * (Paulo Alcantara) [RHEL-34672] - cifs: remove old dead code (Paulo Alcantara) [RHEL-34672] - fs: cifs: Remove repeated struct declaration (Paulo Alcantara) [RHEL-34672] - cifs: have cifs_fattr_to_inode() refuse to change type on live inode (Paulo Alcantara) [RHEL-34672] - cifs: have ->mkdir() handle race with another client sanely (Paulo Alcantara) [RHEL-34672] - do_cifs_create(): don't set ->i_mode of something we had not created (Paulo Alcantara) [RHEL-34672] - cifs: Silently ignore unknown oplock break handle (Paulo Alcantara) [RHEL-34672] - cifs: change noisy error message to FYI (Paulo Alcantara) [RHEL-34672] - cifs: print MIDs in decimal notation (Paulo Alcantara) [RHEL-34672] - cifs: minor simplification to smb2_is_network_name_deleted (Paulo Alcantara) [RHEL-34672] - TCON Reconnect during STATUS_NETWORK_NAME_DELETED (Paulo Alcantara) [RHEL-34672] - cifs: clarify hostname vs ip address in /proc/fs/cifs/DebugData (Paulo Alcantara) [RHEL-34672] - cifs: change confusing field serverName (to ip_addr) (Paulo Alcantara) [RHEL-34672] - cifs: Reformat DebugData and index connections by conn_id. (Paulo Alcantara) [RHEL-34672] - cifs: Identify a connection by a conn_id. (Paulo Alcantara) [RHEL-34672] - smb3: negotiate current dialect (SMB3.1.1) when version 3 or greater requested (Paulo Alcantara) [RHEL-34672] - smb3: Fix out-of-bounds bug in SMB2_negotiate() (Paulo Alcantara) [RHEL-34672] - fs/cifs: Simplify bool comparison. (Paulo Alcantara) [RHEL-34672] - fs/cifs: Assign boolean values to a bool variable (Paulo Alcantara) [RHEL-34672] - cifs: Avoid error pointer dereference (Paulo Alcantara) [RHEL-34672] - cifs: Re-indent cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Unlock on errors in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Delete a stray unlock in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Tracepoints and logs for tracing credit changes. (Paulo Alcantara) [RHEL-34672] - cifs: Fix some error pointers handling detected by static checker (Paulo Alcantara) [RHEL-34672] - smb3: remind users that witness protocol is experimental (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: do not log warning message if server doesn't populate salt (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: update comments clarifying SPNEGO info in negprot response (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot rsp (Paulo Alcantara) [RHEL-34672] - SMB3: avoid confusing warning message on mount to Azure (Paulo Alcantara) [RHEL-34672] - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (Nigel Croxon) [RHEL-46662] {CVE-2024-39476} - net: fix information leakage in /proc/net/ptype (Hangbin Liu) [RHEL-44000] {CVE-2022-48757} - usb: typec: ucsi: Limit read size on v1.2 (Desnes Nunes) [RHEL-37286] {CVE-2024-35924} - minmax: relax check to allow comparison between unsigned arguments and signed constants (Desnes Nunes) [RHEL-37286] - minmax: allow comparisons of 'int' against 'unsigned char/short' (Desnes Nunes) [RHEL-37286] - minmax: allow min()/max()/clamp() if the arguments have the same signedness. (Desnes Nunes) [RHEL-37286] - minmax: add umin(a, b) and umax(a, b) (Desnes Nunes) [RHEL-37286] - minmax: fix header inclusions (Desnes Nunes) [RHEL-37286] - minmax: clamp more efficiently by avoiding extra comparison (Desnes Nunes) [RHEL-37286] - minmax: sanity check constant bounds when clamping (Desnes Nunes) [RHEL-37286] - tracing: Define the is_signed_type() macro once (Desnes Nunes) [RHEL-37286] - linux/bits.h: fix compilation error with GENMASK (Desnes Nunes) [RHEL-37286] - x86/apic: Mask IOAPIC entries when disabling the local APIC (Lenny Szubowicz) [RHEL-18077] - userfaultfd: fix a race between writeprotect and exit_mmap() (Rafael Aquini) [RHEL-38410] {CVE-2021-47461} - mm: khugepaged: skip huge page collapse for special files (Waiman Long) [RHEL-38446] {CVE-2021-47491} - cachefiles: fix memory leak in cachefiles_add_cache() (Andrey Albershteyn) [RHEL-33109] {CVE-2024-26840} - drm/amd/display: Implement bounds check for stream encoder creation in DCN301 (Michel Dänzer) [RHEL-31429] {CVE-2024-26660} - net/mlx5: Discard command completions in internal error (Kamal Heib) [RHEL-44231] {CVE-2024-38555} - drm: Don't unref the same fb many times by mistake due to deadlock handling (CKI Backport Bot) [RHEL-29011] {CVE-2023-52486} - md: fix resync softlockup when bitmap size is less than array size (Nigel Croxon) [RHEL-43942] {CVE-2024-38598} - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation (Davide Caratti) [RHEL-39712] {CVE-2024-36017} - netfilter: nf_tables: discard table flag update with pending basechain deletion (Phil Sutter) [RHEL-37205] {CVE-2024-35897} - netfilter: nf_tables: reject table flag and netdev basechain updates (Phil Sutter) [RHEL-37205] - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (Ewan D. Milne) [RHEL-40172] {CVE-2024-36924} - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (Ewan D. Milne) [RHEL-40172] {CVE-2024-36952} - netfilter: nf_tables: fix memleak in map from abort path (Phil Sutter) [RHEL-35052] {CVE-2024-27011} - netfilter: nf_tables: reject new basechain after table flag update (Phil Sutter) [RHEL-37193] {CVE-2024-35900} - netfilter: nf_tables: flush pending destroy work before exit_net release (Phil Sutter) [RHEL-37197] {CVE-2024-35899} - netfilter: complete validation of user input (Phil Sutter) [RHEL-37210] - netfilter: validate user input for expected length (Phil Sutter) [RHEL-37210] {CVE-2024-35896} - netfilter: tproxy: bail out if IP has been disabled on the device (Phil Sutter) [RHEL-44363] {CVE-2024-36270} - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (Phil Sutter) [RHEL-44532] {CVE-2024-36286} - netfilter: nf_tables: do not compare internal table flags on updates (Phil Sutter) [RHEL-35114] {CVE-2024-27065} - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (Phil Sutter) [RHEL-35028] {CVE-2024-27019} - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (Phil Sutter) [RHEL-35024] {CVE-2024-27020} - netfilter: nf_tables: __nft_expr_type_get() selects specific family type (Phil Sutter) [RHEL-35024] - netfilter: conntrack: serialize hash resizes and cleanups (Phil Sutter) [RHEL-37703] {CVE-2021-47408} - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (Phil Sutter) [RHEL-34217] {CVE-2024-26925} - netfilter: nf_tables: release batch on table validation from abort path (Phil Sutter) [RHEL-34217] - ipvlan: add ipvlan_route_v6_outbound() helper (Davide Caratti) [RHEL-38319] {CVE-2023-52796} - [rt] build kernel-rt-4.18.0-553.12.1.rt7.353.el8_10 [RHEL-44553] - net: bridge: xmit: make sure we have at least eth header len bytes (cki-backport-bot) [RHEL-44291] {CVE-2024-38538} - drivers/amd/pm: fix a use-after-free in kv_parse_power_table (Michel Dänzer) [RHEL-26893] {CVE-2023-52469} - SUNRPC: Fix a suspicious RCU usage warning (Scott Mayhew) [RHEL-30503] {CVE-2023-52623} - ice: Fix some null pointer dereference issues in ice_ptp.c (Petr Oros) [RHEL-26901] {CVE-2023-52471} - xfs: fix internal error from AGFL exhaustion (Pavel Reichl) [RHEL-45581] - sched/psi: Fix use-after-free in ep_remove_wait_queue() (Phil Auld) [RHEL-38117] {CVE-2023-52707} - wait: add wake_up_pollfree() (Phil Auld) [RHEL-38117] - net/ipv6: avoid possible UAF in ip6_route_mpath_notify() (Hangbin Liu) [RHEL-33269] {CVE-2024-26852} - net: bridge: switchdev: Skip MDB replays of deferred events on offload (Ivan Vecera) [RHEL-33117] {CVE-2024-26837} - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (Pavel Reichl) [RHEL-31700] {CVE-2024-26772} - ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() (Pavel Reichl) [RHEL-31688] {CVE-2024-26773} - ext4: fix double-free of blocks due to wrong extents moved_len (Pavel Reichl) [RHEL-31612] {CVE-2024-26704} - vxlan: Pull inner IP header in vxlan_xmit_one(). (Guillaume Nault) [RHEL-31389] - geneve: Fix incorrect inner network header offset when innerprotoinherit is set (Guillaume Nault) [RHEL-31389] - vxlan: Pull inner IP header in vxlan_rcv(). (Guillaume Nault) [RHEL-31389] - geneve: fix header validation in geneve[6]_xmit_skb (Guillaume Nault) [RHEL-31389] - geneve: make sure to pull inner header in geneve_rx() (Guillaume Nault) [RHEL-31389] - net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb (Guillaume Nault) [RHEL-31389] - net: geneve: check skb is large enough for IPv4/IPv6 header (Guillaume Nault) [RHEL-31389] - net/smc: fix neighbour and rtable leak in smc_ib_find_route() (Tobias Huschle) [RHEL-39744] {CVE-2024-36945} - igb: Fix string truncation warnings in igb_set_fw_version (Corinna Vinschen) [RHEL-38452] {CVE-2024-36010} - bonding: stop the device in bond_setup_by_slave() (Hangbin Liu) [RHEL-38327] {CVE-2023-52784} - i40e: fix vf may be used uninitialized in this function warning (Kamal Heib) [RHEL-39702] {CVE-2024-36020} - powerpc/64: Fix the definition of the fixmap area (Mamatha Inamdar) [RHEL-27191] {CVE-2021-47018} - powerpc/mm/hash64: Add a variable to track the end of IO mapping (Mamatha Inamdar) [RHEL-27191] {CVE-2021-47018} - nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). (Xin Long) [RHEL-39770] {CVE-2024-36933} - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (Xin Long) [RHEL-39770] - net: core: reject skb_copy(_expand) for fraglist GSO skbs (Xin Long) [RHEL-39779] {CVE-2024-36929} - tcp: properly terminate timers for kernel sockets (Guillaume Nault) [RHEL-37171] {CVE-2024-35910} - net: relax socket state check at accept time. (Florian Westphal) [RHEL-39831] - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (Florian Westphal) [RHEL-39831] {CVE-2024-36905} - tcp: remove redundant check on tskb (Florian Westphal) [RHEL-39831] - drm/ast: Fix soft lockup (cki-backport-bot) [RHEL-37438] {CVE-2024-35952} - null_blk: Fix return value of nullb_device_power_store() (Ming Lei) [RHEL-39341] - null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues' (Ming Lei) [RHEL-39341] - null_blk: fix return value from null_add_dev() (Ming Lei) [RHEL-39341] - [rt] build kernel-rt-4.18.0-553.11.1.rt7.352.el8_10 [RHEL-44553] - x86/bugs: Reverse instruction order of CLEAR_CPU_BUFFERS (Waiman Long) [RHEL-42121] - Revert "x86/bugs: Use fixed addressing for VERW operand" (Waiman Long) [RHEL-42121] - KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests (Waiman Long) [RHEL-42121] - x86/rfds: Mitigate Register File Data Sampling (RFDS) (Waiman Long) [RHEL-42121] - Documentation/hw-vuln: Add documentation for RFDS (Waiman Long) [RHEL-42121] - x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set (Waiman Long) [RHEL-42121] - x86/bugs: Use fixed addressing for VERW operand (Waiman Long) [RHEL-42121] - KVM/VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH (Waiman Long) [RHEL-42121] - x86/bugs: Use ALTERNATIVE() instead of mds_user_clear static key (Waiman Long) [RHEL-42121] - x86/entry_32: Add VERW just before userspace transition (Waiman Long) [RHEL-42121] - x86/entry_64: Add VERW just before userspace transition (Waiman Long) [RHEL-42121] - x86/bugs: Add asm helpers for executing VERW (Waiman Long) [RHEL-42121] - x86/cpu: Fix Gracemont uarch (Waiman Long) [RHEL-42121] - Documentation/hw-vuln: Unify filename specification in index (Waiman Long) [RHEL-42121] - KVM: VMX: Access @flags as a 32-bit value in __vmx_vcpu_run() (Waiman Long) [RHEL-42121] - x86/asm: Add _ASM_RIP() macro for x86-64 (%rip) suffix (Waiman Long) [RHEL-42121] - x86/asm: Have the __ASM_FORM macros handle commas in arguments (Waiman Long) [RHEL-42121] - x86/asm: Allow to pass macros to __ASM_FORM() (Waiman Long) [RHEL-42121] - wifi: iwlwifi: mvm: guard against invalid STA ID on removal (Jose Ignacio Tornos Martinez) [RHEL-39801] {CVE-2024-36921} - ipv6: Fix potential uninit-value access in __ip6_make_skb() (Antoine Tenart) [RHEL-39784] - ipv4: Fix uninit-value access in __ip_make_skb() (Antoine Tenart) [RHEL-39784] {CVE-2024-36927} - perf mmap: Lazily initialize zstd streams to save memory when not using it (Michael Petlan) [RHEL-34876] - perf tools: Fix spelling mistake "commpressor" -> "compressor" (Michael Petlan) [RHEL-34876] - perf record: Introduce data transferred and compressed stats (Michael Petlan) [RHEL-34876] - perf record: Introduce compressor at mmap buffer object (Michael Petlan) [RHEL-34876] - perf record: Introduce bytes written stats (Michael Petlan) [RHEL-34876] - perf record: Introduce data file at mmap buffer object (Michael Petlan) [RHEL-34876] - perf record: Start threads in the beginning of trace streaming (Alexey Bayduraev) [RHEL-34876] - perf record: Stop threads in the end of trace streaming (Michael Petlan) [RHEL-34876] - perf record: Introduce thread local variable (Michael Petlan) [RHEL-34876] - perf record: Introduce function to propagate control commands (Michael Petlan) [RHEL-34876] - perf record: Introduce thread specific data array (Michael Petlan) [RHEL-34876] - tools lib: Introduce fdarray duplicate function (Michael Petlan) [RHEL-34876] - perf record: Introduce thread affinity and mmap masks (Michael Petlan) [RHEL-34876] - gfs2: Be more careful with the quota sync generation (Andreas Gruenbacher) [RHEL-40901] - gfs2: Get rid of some unnecessary quota locking (Andreas Gruenbacher) [RHEL-40901] - gfs2: Add some missing quota locking (Andreas Gruenbacher) [RHEL-40901] - gfs2: Fold qd_fish into gfs2_quota_sync (Andreas Gruenbacher) [RHEL-40901] - gfs2: quota need_sync cleanup (Andreas Gruenbacher) [RHEL-40901] - gfs2: Fix and clean up function do_qc (Andreas Gruenbacher) [RHEL-40901] - gfs2: Revert "Add quota_change type" (Andreas Gruenbacher) [RHEL-40901] - gfs2: Revert "ignore negated quota changes" (Andreas Gruenbacher) [RHEL-40901] - gfs2: qd_check_sync cleanups (Andreas Gruenbacher) [RHEL-40901] - gfs2: Check quota consistency on mount (Andreas Gruenbacher) [RHEL-40901] - gfs2: Minor gfs2_quota_init error path cleanup (Andreas Gruenbacher) [RHEL-40901] - gfs2: fix kernel BUG in gfs2_quota_cleanup (Edward Adam Davis) [RHEL-40901] - gfs2: Clean up quota.c:print_message (Andreas Gruenbacher) [RHEL-40901] - gfs2: Clean up gfs2_alloc_parms initializers (Andreas Gruenbacher) [RHEL-40901] - gfs2: Two quota=account mode fixes (Andreas Gruenbacher) [RHEL-40901] - gfs2: Remove useless assignment (Bob Peterson) [RHEL-40901] - gfs2: simplify slot_get (Bob Peterson) [RHEL-40901] - gfs2: Simplify qd2offset (Bob Peterson) [RHEL-40901] - gfs2: Remove quota allocation info from quota file (Bob Peterson) [RHEL-40901] - gfs2: use constant for array size (Bob Peterson) [RHEL-40901] - gfs2: Set qd_sync_gen in do_sync (Bob Peterson) [RHEL-40901] - gfs2: Remove useless err set (Bob Peterson) [RHEL-40901] - gfs2: Small gfs2_quota_lock cleanup (Bob Peterson) [RHEL-40901] - gfs2: move qdsb_put and reduce redundancy (Bob Peterson) [RHEL-40901] - gfs2: Don't try to sync non-changes (Bob Peterson) [RHEL-40901] - gfs2: Simplify function need_sync (Bob Peterson) [RHEL-40901] - gfs2: remove unneeded pg_oflow variable (Bob Peterson) [RHEL-40901] - gfs2: remove unneeded variable done (Bob Peterson) [RHEL-40901] - gfs2: pass sdp to gfs2_write_buf_to_page (Bob Peterson) [RHEL-40901] - gfs2: pass sdp in to gfs2_write_disk_quota (Bob Peterson) [RHEL-40901] - gfs2: Pass sdp to gfs2_adjust_quota (Bob Peterson) [RHEL-40901] - gfs2: remove dead code for quota writes (Bob Peterson) [RHEL-40901] - gfs2: Use qd_sbd more consequently (Bob Peterson) [RHEL-40901] - gfs2: replace 'found' with dedicated list iterator variable (Jakob Koschel) [RHEL-40901] - gfs2: Some whitespace cleanups (Andreas Gruenbacher) [RHEL-40901] - gfs2: Fix gfs2_qa_get imbalance in gfs2_quota_hold (Bob Peterson) [RHEL-40901] - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg (Guillaume Nault) [RHEL-43961] {CVE-2024-38596} - af_unix: Fix data-races around sk->sk_shutdown. (Guillaume Nault) [RHEL-43961] {CVE-2024-38596} - af_unix: Fix data races around sk->sk_shutdown. (Guillaume Nault) [RHEL-43961] {CVE-2024-38596} - perf/core: Fix event sibling list locking (Daniel Vacek) [RHEL-31798] - media: bttv: fix use after free error due to btv->timeout timer (Kate Hsuan) [RHEL-38256] {CVE-2023-52847} - arp: Prevent overflow in arp_req_get(). (Antoine Tenart) [RHEL-31706] {CVE-2024-26733} - Bluetooth: btusb: Add a new PID/VID 0489/e0c8 for MT7921 (David Marlin) [RHEL-10263] - mm: swap: fix race between free_swap_and_cache() and swapoff() (Waiman Long) [RHEL-34971] {CVE-2024-26960} - swap: comments get_swap_device() with usage rule (Waiman Long) [RHEL-34971] {CVE-2024-26960} - mm/swapfile.c: __swap_entry_free() always free 1 entry (Waiman Long) [RHEL-34971] {CVE-2024-26960} - mm/swapfile.c: call free_swap_slot() in __swap_entry_free() (Waiman Long) [RHEL-34971] {CVE-2024-26960} - mm/swapfile.c: use __try_to_reclaim_swap() in free_swap_and_cache() (Waiman Long) [RHEL-34971] {CVE-2024-26960} - net: amd-xgbe: Fix skb data length underflow (Ken Cox) [RHEL-43788] {CVE-2022-48743} - ovl: fix warning in ovl_create_real() (cki-backport-bot) [RHEL-43652] {CVE-2021-47579} - net/sched: initialize noop_qdisc owner (Davide Caratti) [RHEL-35056] - net/sched: Fix mirred deadlock on device recursion (Davide Caratti) [RHEL-35056] {CVE-2024-27010} - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (Pavel Reichl) [RHEL-45029] {CVE-2024-39276} - ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() (Ken Cox) [RHEL-38713] {CVE-2021-47548} - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound (Hangbin Liu) [RHEL-44396] {CVE-2024-33621} - mlxsw: spectrum_acl_tcam: Fix stack corruption (Ivan Vecera) [RHEL-26462] {CVE-2024-26586} - inet: inet_defrag: prevent sk release while still in use (Antoine Tenart) [RHEL-33398] {CVE-2024-26921} - skb_expand_head() adjust skb->truesize incorrectly (Antoine Tenart) [RHEL-33398] - nvmet: fix ns enable/disable possible hang (Ming Lei) [RHEL-43547] - [rt] build kernel-rt-4.18.0-553.10.1.rt7.351.el8_10 [RHEL-44553] - SUNRPC: Fix RPC client cleaned up the freed pipefs dentries (Scott Mayhew) [RHEL-38264] {CVE-2023-52803} - scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() (Ewan D. Milne) [RHEL-39717] {CVE-2024-36025} - tcp: add sanity checks to rx zerocopy (Guillaume Nault) [RHEL-29494] {CVE-2024-26640} - SUNRPC: fix some memleaks in gssx_dec_option_array (Scott Mayhew) [RHEL-35209] {CVE-2024-27388} - wifi: nl80211: don't free NULL coalescing rule (Jose Ignacio Tornos Martinez) [RHEL-39752] {CVE-2024-36941} - nfs: fix UAF in direct writes (Scott Mayhew) [RHEL-34975] {CVE-2024-26958} - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 (Scott Mayhew) [RHEL-33228] {CVE-2024-26870} - drm/amd/pm: Fix error of MACO flag setting code (Michel Dänzer) [RHEL-15928] - scsi: aacraid: fix io hangs and improve performance (John Meneghini) [RHEL-23913] - block: prevent division by zero in blk_rq_stat_sum() (Ming Lei) [RHEL-37279] {CVE-2024-35925} - block: fix overflow in blk_ioctl_discard() (Ming Lei) [RHEL-39811] {CVE-2024-36917} - virtio-blk: fix implicit overflow on virtio_max_dma_size (Ming Lei) [RHEL-38131] {CVE-2023-52762} - nbd: null check for nla_nest_start (Ming Lei) [RHEL-35176] {CVE-2024-27025} - isdn: mISDN: netjet: Fix crash in nj_probe: (Ken Cox) [RHEL-38444] {CVE-2021-47284} - isdn: mISDN: Fix sleeping function called from invalid context (Ken Cox) [RHEL-38400] {CVE-2021-47468} - net/smc: avoid data corruption caused by decline (Tobias Huschle) [RHEL-38234] {CVE-2023-52775} - ubi: Check for too small LEB size in VTBL code (David Arcari) [RHEL-25092] {CVE-2024-25739} - i2c: core: Fix atomic xfer check for non-preempt config (Steve Best) [RHEL-38313] {CVE-2023-52791} - i2c: core: Run atomic i2c xfer when !preemptible (Steve Best) [RHEL-38313] {CVE-2023-52791} - firewire: ohci: mask bus reset interrupts between ISR and bottom half (Steve Best) [RHEL-39902] {CVE-2024-36950} - ipv6: init the accept_queue's spinlocks in inet6_create (Guillaume Nault) [RHEL-28899] {CVE-2024-26614} - tcp: make sure init the accept_queue's spinlocks once (Guillaume Nault) [RHEL-28899] {CVE-2024-26614} - tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (Steve Best) [RHEL-39352] {CVE-2024-36016} - mlxsw: spectrum_acl_tcam: Fix incorrect list API usage (Ivan Vecera) [RHEL-37484] {CVE-2024-36006} - pwm: Fix double shift bug (Steve Best) [RHEL-38278] {CVE-2023-52756} - mmc: sdio: fix possible resource leaks in some error paths (Steve Best) [RHEL-38149] {CVE-2023-52730} - of: unittest: Fix compile in the non-dynamic case (Steve Best) [RHEL-37070] {CVE-2023-52679} - of: unittest: Fix of_count_phandle_with_args() expected value message (Steve Best) [RHEL-37070] {CVE-2023-52679} - of: Fix double free in of_parse_phandle_with_args_map (Steve Best) [RHEL-37070] {CVE-2023-52679} - pinctrl: core: delete incorrect free in pinctrl_enable() (Steve Best) [RHEL-39756] {CVE-2024-36940} - pinctrl: core: fix possible memory leak in pinctrl_enable() (Steve Best) [RHEL-39756] {CVE-2024-36940} - media: gspca: cpia1: shift-out-of-bounds in set_flicker (Desnes Nunes) [RHEL-38331] {CVE-2023-52764} - tipc: fix a possible memleak in tipc_buf_append (Xin Long) [RHEL-39881] {CVE-2024-36954} - cifs: fix mid leak during reconnection after timeout threshold (Paulo Alcantara) [RHEL-36222] - cifs: Fix use-after-free in rdata->read_into_pages() (Paulo Alcantara) [RHEL-36222] - cifs: Fix pages leak when writedata alloc failed in cifs_write_from_iter() (Paulo Alcantara) [RHEL-36222] - cifs: Fix pages array leak when writedata alloc failed in cifs_writedata_alloc() (Paulo Alcantara) [RHEL-36222] - cifs: destage dirty pages before re-reading them for cache=none (Paulo Alcantara) [RHEL-36222] - cifs: destage any unwritten data to the server before calling copychunk_write (Paulo Alcantara) [RHEL-36222] - Adjust cifssb maximum read size (Paulo Alcantara) [RHEL-36222] - cifs: make locking consistent around the server session status (Paulo Alcantara) [RHEL-36222] - cifs: fix credit accounting for extra channel (Paulo Alcantara) [RHEL-36222] - smb3: prevent races updating CurrentMid (Paulo Alcantara) [RHEL-36222] - cifs: fix missing spinlock around update to ses->status (Paulo Alcantara) [RHEL-36222] - cifs: use echo_interval even when connection not ready. (Paulo Alcantara) [RHEL-36222] - cifs: detect dead connections only when echoes are enabled. (Paulo Alcantara) [RHEL-36222] - cifs: Fix preauth hash corruption (Paulo Alcantara) [RHEL-36222] - cifs: do not send close in compound create+close requests (Paulo Alcantara) [RHEL-36222] - cifs: ask for more credit on async read/write code paths (Paulo Alcantara) [RHEL-36222] - cifs: use discard iterator to discard unneeded network data more efficiently (Paulo Alcantara) [RHEL-36222] - cifs: Fix in error types returned for out-of-credit situations. (Paulo Alcantara) [RHEL-36222] - smb3: fix crediting for compounding when only one request in flight (Paulo Alcantara) [RHEL-36222] - cifs: New optype for session operations. (Paulo Alcantara) [RHEL-36222] - mm/gup: do not return 0 from pin_user_pages_fast() for bad args (Paulo Alcantara) [RHEL-36222] - wifi: brcmfmac: pcie: handle randbuf allocation failure (Jose Ignacio Tornos Martinez) [RHEL-44124] {CVE-2024-38575} - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). (Guillaume Nault) [RHEL-39835] {CVE-2024-36904} - wifi: mac80211: don't return unset power in ieee80211_get_tx_power() (Jose Ignacio Tornos Martinez) [RHEL-38159] {CVE-2023-52832} - wifi: ath11k: fix gtk offload status event locking (Jose Ignacio Tornos Martinez) [RHEL-38155] {CVE-2023-52777} - net: ieee802154: fix null deref in parse dev addr (Steve Best) [RHEL-38012] {CVE-2021-47257} - mm/hugetlb: fix missing hugetlb_lock for resv uncharge (Rafael Aquini) [RHEL-37465] {CVE-2024-36000} - x86/xen: Add some null pointer checking to smp.c (Vitaly Kuznetsov) [RHEL-33258] {CVE-2024-26908} - x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() (Vitaly Kuznetsov) [RHEL-33258] {CVE-2024-26908} - wifi: cfg80211: check A-MSDU format more carefully (Jose Ignacio Tornos Martinez) [RHEL-37343] {CVE-2024-35937} - wifi: rtw89: fix null pointer access when abort scan (Jose Ignacio Tornos Martinez) [RHEL-37355] {CVE-2024-35946} - atl1c: Work around the DMA RX overflow issue (Ken Cox) [RHEL-38287] {CVE-2023-52834} - wifi: ath11k: decrease MHI channel buffer length to 8KB (Jose Ignacio Tornos Martinez) [RHEL-37339] {CVE-2024-35938} - wifi: iwlwifi: mvm: rfi: fix potential response leaks (Jose Ignacio Tornos Martinez) [RHEL-37163] {CVE-2024-35912} - USB: core: Fix access violation during port device removal (Desnes Nunes) [RHEL-39853] {CVE-2024-36896} - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() (Ewan D. Milne) [RHEL-37123] {CVE-2024-35930} - netfilter: nf_tables: honor table dormant flag from netdev release event path (Phil Sutter) [RHEL-37450] {CVE-2024-36005} - wifi: iwlwifi: mvm: don't set the MFP flag for the GTK (Jose Ignacio Tornos Martinez) [RHEL-36898] {CVE-2024-27434} - wifi: iwlwifi: mvm: Fix key flags for IGTK on AP interface (Jose Ignacio Tornos Martinez) [RHEL-36898] {CVE-2024-27434} - misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspend/resume (Steve Best) [RHEL-36932] {CVE-2024-35824} - [rt] build kernel-rt-4.18.0-553.9.1.rt7.350.el8_10 [RHEL-44553] - x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (Steve Best) [RHEL-37262] {CVE-2024-35876} - net/sched: flower: Fix chain template offload (Xin Long) [RHEL-31313] {CVE-2024-26669} - SUNRPC: fix a memleak in gss_import_v2_context (Scott Mayhew) [RHEL-35195] {CVE-2023-52653} - efivarfs: force RO when remounting if SetVariable is not supported (Pavel Reichl) [RHEL-26564] {CVE-2023-52463} - dmaengine: idxd: add a write() method for applications to submit work (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823} - dmaengine: idxd: add a new security check to deal with a hardware erratum (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823} - VFIO: Add the SPR_DSA and SPR_IAX devices to the denylist (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823} - quota: Fix potential NULL pointer dereference (Pavel Reichl) [RHEL-33219] {CVE-2024-26878} - locking/lockdep: Fix overflow in presentation of average lock-time (Čestmír Kalina) [RHEL-17678] - blk-cgroup: Properly propagate the iostat update up the hierarchy (Ming Lei) [RHEL-40939] - proc: Use new_inode not new_inode_pseudo (Ian Kent) [RHEL-40167] - stmmac: Clear variable when destroying workqueue (Izabela Bakollari) [RHEL-31822] {CVE-2024-26802} - powerpc/pseries/memhp: Fix access beyond end of drmem array (Mamatha Inamdar) [RHEL-26495] {CVE-2023-52451} - platform/x86: wmi: Fix opening of char device (David Arcari) [RHEL-38258] {CVE-2023-52864} - Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" (Kamal Heib) [RHEL-36908] {CVE-2023-52658} - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed (Cathy Avery) [RHEL-39074] - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove (Cathy Avery) [RHEL-39074] - hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes (Cathy Avery) [RHEL-39074] - hv_netvsc: remove duplicated including of slab.h (Cathy Avery) [RHEL-39074] - hv_netvsc: rndis_filter needs to select NLS (Cathy Avery) [RHEL-39074] - hv_netvsc: Mark VF as slave before exposing it to user-mode (Cathy Avery) [RHEL-39074] - hv_netvsc: Fix race of register_netdevice_notifier and VF register (Cathy Avery) [RHEL-39074] - hv_netvsc: fix race of netvsc and VF register_netdevice (Cathy Avery) [RHEL-39074] - hv_netvsc: fix netvsc_send_completion to avoid multiple message length checks (Cathy Avery) [RHEL-39074] - hv_netvsc: Allocate rx indirection table size dynamically (Cathy Avery) [RHEL-39074] - net: hv_netvsc: Fix a warning triggered by memcpy in rndis_filter (Cathy Avery) [RHEL-39074] - gfs2: Fix lru_count accounting (Andreas Gruenbacher) [RHEL-32941] - gfs2: Fix "Make glock lru list scanning safer" (Andreas Gruenbacher) [RHEL-32941] - gfs2: Fix "ignore unlock failures after withdraw" (Andreas Gruenbacher) [RHEL-32941] - gfs2: Don't set GLF_LOCK in gfs2_dispose_glock_lru (Andreas Gruenbacher) [RHEL-32941] - gfs2: Don't forget to complete delayed withdraw (Andreas Gruenbacher) [RHEL-32941] - gfs2: Delay withdraw from atomic context (Andreas Gruenbacher) [RHEL-32941] - gfs2: trivial clean up of gfs2_ail_error (Andreas Gruenbacher) [RHEL-32941] - ext4: fix corruption during on-line resize (Carlos Maiolino) [RHEL-36974] {CVE-2024-35807} - ext4: correct offset of gdb backup in non meta_bg group to update_backups (Carlos Maiolino) [RHEL-36974] - ext4: avoid online resizing failures due to oversized flex bg (Carlos Maiolino) [RHEL-30507] {CVE-2023-52622} - ext4: use time_is_before_jiffies() instead of open coding it (Carlos Maiolino) [RHEL-30507] - ext4: unify the type of flexbg_size to unsigned int (Carlos Maiolino) [RHEL-30507] - ext4: remove unnecessary check from alloc_flex_gd() (Carlos Maiolino) [RHEL-30507] - tracing: Do no increment trace_clock_global() by one (Jerome Marchand) [RHEL-27107] {CVE-2021-46939} - tracing: Restructure trace_clock_global() to never block (Jerome Marchand) [RHEL-27107] {CVE-2021-46939} - net/sched: act_skbmod: prevent kernel-infoleak (Xin Long) [RHEL-37220] {CVE-2024-35893} - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (Xin Long) [RHEL-38307] {CVE-2023-52845} - redhat: remove the merge subtrees script (Derek Barbosa) - redhat: rhdocs: delete .get_maintainer.conf (Derek Barbosa) - redhat: rhdocs: Remove the rhdocs directory (Derek Barbosa) - dyndbg: fix old BUG_ON in >control parser (Waiman Long) [RHEL-37111] {CVE-2024-35947} - dyndbg: let query-modname override actual module name (Waiman Long) [RHEL-37111] - dyndbg: make dyndbg a known cli param (Waiman Long) [RHEL-37111] - lan78xx: Fix exception on link speed change (Jamie Bainbridge) [RHEL-33437] - net: usb: lan78xx: don't modify phy_device state concurrently (Jamie Bainbridge) [RHEL-33437] - efi: runtime: Fix potential overflow of soft-reserved region size (Lenny Szubowicz) [RHEL-33096] {CVE-2024-26843} - perf/arm-cmn: Fail DTC counter allocation correctly (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Rework DTC counters (again) (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Fix DTC domain detection (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Revamp model detection (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Fix port detection for CMN-700 (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Move overlapping wp_combine field (Michael Petlan) [RHEL-23841] - Partially revert "perf/arm-cmn: Optimise DTC counter accesses" (Michael Petlan) [RHEL-23841] - drivers/perf: Compile with gnu99 standard (Michael Petlan) [RHEL-23841] - x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (Steve Best) [RHEL-36994] {CVE-2024-35801} - watchdog: softdog: Add options 'soft_reboot_cmd' and 'soft_active_on_boot' (Waiman Long) [RHEL-19723] - tipc: fix UAF in error path (Xin Long) [RHEL-34278] {CVE-2024-36886} - [rt] build kernel-rt-4.18.0-553.8.1.rt7.349.el8_10 [RHEL-40882] - udf: Fix NULL pointer dereference in udf_symlink function (Pavel Reichl) [RHEL-37769] {CVE-2021-47353} - net: ti: fix UAF in tlan_remove_one (Jose Ignacio Tornos Martinez) [RHEL-38940] {CVE-2021-47310} - ARM: footbridge: fix PCI interrupt mapping (Myron Stowe) [RHEL-26971] {CVE-2021-46909} - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (Kamal Heib) [RHEL-37454] {CVE-2024-36004} - net/mlx5e: Fix mlx5e_priv_init() cleanup flow (Kamal Heib) [RHEL-37424] {CVE-2024-35959} - net/mlx5: Properly link new fs rules into the tree (Kamal Heib) [RHEL-37420] {CVE-2024-35960} - net/mlx5e: fix a potential double-free in fs_any_create_groups (Kamal Heib) [RHEL-37091] {CVE-2023-52667} - net: ena: Fix incorrect descriptor free behavior (Kamal Heib) [RHEL-37428] {CVE-2024-35958} - mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - mISDN: fix possible use-after-free in HFC_cleanup() (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - implement dh fallback for primes > 4K (Vladis Dronov) [RHEL-35106] - crypto: qat - avoid division by zero (Vladis Dronov) [RHEL-35106] - crypto: qat - resolve race condition during AER recovery (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - use kcalloc_node() instead of kzalloc_node() (Vladis Dronov) [RHEL-35106] - [rt] Enable CONFIG_DRM_MGAG200_DISABLE_WRITECOMBINE (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Add an option to disable Write-Combine (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Fix caching setup for remapped video memory (Jocelyn Falempe) [RHEL-36172] - Revert "drm/mgag200: Add a workaround for low-latency" (Jocelyn Falempe) [RHEL-36172] - mptcp: fix data re-injection from stale subflow (Davide Caratti) [RHEL-33133] {CVE-2024-26826} - ipv6: sr: fix incorrect unregister order (Hangbin Liu) [RHEL-31730] - ipv6: sr: fix possible use-after-free and null-ptr-deref (Hangbin Liu) [RHEL-31730] {CVE-2024-26735} - net/bnx2x: Prevent access to a freed page in page_pool (Michal Schmidt) [RHEL-14195 RHEL-33243] {CVE-2024-26859} - bnx2x: new flag for track HW resource allocation (Michal Schmidt) [RHEL-14195 RHEL-33243] - bnx2x: fix page fault following EEH recovery (Michal Schmidt) [RHEL-14195 RHEL-33243] - x86: KVM: SVM: always update the x2avic msr interception (Maxim Levitsky) [RHEL-15495] {CVE-2023-5090} - EDAC/thunderx: Fix possible out-of-bounds string access (Aristeu Rozanski) [RHEL-26573] {CVE-2023-52464} - [rt] build kernel-rt-4.18.0-553.7.1.rt7.348.el8_10 [RHEL-34640] - net: qcom/emac: fix UAF in emac_remove (Ken Cox) [RHEL-37834] {CVE-2021-47311} - perf/core: Bail out early if the request AUX area is out of bound (Michael Petlan) [RHEL-38268] {CVE-2023-52835} - crypto: pcrypt - Fix hungtask for PADATA_RESET (Herbert Xu) [RHEL-38171] {CVE-2023-52813} - drm/amdgpu: fix use-after-free bug (Jocelyn Falempe) [RHEL-31240] {CVE-2024-26656} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash (Ivan Vecera) [RHEL-37008] {CVE-2024-35854} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update (Ivan Vecera) [RHEL-37004] {CVE-2024-35855} - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (Ivan Vecera) [RHEL-37012] {CVE-2024-35853} - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work (Ivan Vecera) [RHEL-37016] {CVE-2024-35852} - mlxsw: spectrum_acl_tcam: Fix warning during rehash (Ivan Vecera) [RHEL-37480] {CVE-2024-36007} - can: peak_pci: peak_pci_remove(): fix UAF (Jose Ignacio Tornos Martinez) [RHEL-38419] {CVE-2021-47456} - usbnet: fix error return code in usbnet_probe() (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - usbnet: sanity check for maxpacket (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - net/mlx5e: fix a double-free in arfs_create_groups (Kamal Heib) [RHEL-36920] {CVE-2024-35835} - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds (Jose Ignacio Tornos Martinez) [RHEL-38220] {CVE-2023-52878} - net: cdc_eem: fix tx fixup skb leak (Jose Ignacio Tornos Martinez) [RHEL-38080] {CVE-2021-47236} - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Jose Ignacio Tornos Martinez) [RHEL-38113] {CVE-2023-52703} - usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() (Desnes Nunes) [RHEL-38248] {CVE-2023-52877} - usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (Desnes Nunes) [RHEL-38240] {CVE-2023-52781} - gro: fix ownership transfer (Xin Long) [RHEL-37226] {CVE-2024-35890} - tipc: fix kernel warning when sending SYN message (Xin Long) [RHEL-38109] {CVE-2023-52700} - erspan: make sure erspan_base_hdr is present in skb->head (Xin Long) [RHEL-37230] {CVE-2024-35888} - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() (Bryan Gurney) [RHEL-17366] - scsi: mpi3mr: Sanitise num_phys (Bryan Gurney) [RHEL-17366] - netfilter: nf_tables: use timestamp to check for set element timeout (Phil Sutter) [RHEL-38023] {CVE-2024-27397} - net/ipv6: SKB symmetric hash should incorporate transport ports (Sabrina Dubroca) [RHEL-32061] - crypto: s390/aes - Fix buffer overread in CTR mode (Herbert Xu) [RHEL-37089] {CVE-2023-52669} - net: Save and restore msg_namelen in sock_sendmsg (Jamie Bainbridge) [RHEL-35893] - net: prevent address rewrite in kernel_bind() (Jamie Bainbridge) [RHEL-35893] - net: prevent rewrite of msg_name in sock_sendmsg() (Jamie Bainbridge) [RHEL-35893] - net: replace calls to sock->ops->connect() with kernel_connect() (Jamie Bainbridge) [RHEL-35893] - net: Avoid address overwrite in kernel_connect (Jamie Bainbridge) [RHEL-35893] - wifi: iwlwifi: dbg-tlv: ensure NUL termination (Jose Ignacio Tornos Martinez) [RHEL-37026] {CVE-2024-35845} - wifi: mac80211: fix potential sta-link leak (Jose Ignacio Tornos Martinez) [RHEL-36916] {CVE-2024-35838} - wifi: nl80211: reject iftype change with mesh ID change (Jose Ignacio Tornos Martinez) [RHEL-36884] {CVE-2024-27410} - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (Jose Ignacio Tornos Martinez) [RHEL-36807] {CVE-2024-35789} - Bluetooth: Avoid potential use-after-free in hci_error_reset (David Marlin) [RHEL-31826] {CVE-2024-26801} - tls: disable async encrypt/decrypt (Sabrina Dubroca) [RHEL-26362 RHEL-26409 RHEL-26420] {CVE-2024-26585 CVE-2024-26583 CVE-2024-26584} - Squashfs: check the inode number is not the invalid value of zero (Phillip Lougher) [RHEL-35096] {CVE-2024-26982} - ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/msg.c: update and document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/sem.c: document and update memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: update/document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: remove duplicated code (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (Kamal Heib) [RHEL-30582] {CVE-2023-52626} - Revert "ACPI: bus: Rework system-level device notification handling" (Prarit Bhargava) [RHEL-21486] - hwrng: core - Fix page fault dead lock on mmap-ed hwrng (Prarit Bhargava) [RHEL-29485] {CVE-2023-52615} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - powerpc/pseries: pci - logic bug (Mamatha Inamdar) [RHEL-240146] - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228} - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899] {CVE-2026-90036} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680] {CVE-2026-72262} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641} - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781] {CVE-2026-74583} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916] {CVE-2026-68377} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271288] {CVE-2026-89631} - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280060] {CVE-2026-98320} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271853] {CVE-2026-93817} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191034] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191034] {CVE-2026-53196} - gfs2: a minor finish_xmote cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor run_queue fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: only apply DLM_LKF_VALBLK if sb_lvbptr is not NULL (Alexander Aring) [RHEL-129363] - gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Use wait_event_freezable_timeout() for freezable kthread (Andreas Gruenbacher) [RHEL-129363] - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-129363] - gfs2: low-memory forced flush fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: add missing withdraw locking (Andreas Gruenbacher) [RHEL-129363] - gfs2: Disable GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename "gfs_recovery" workqueue to "gfs2_recovery" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-129363] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-129363] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify do_promote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-129363] - gfs2: introduce new gfs2_glock_assert_withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify refcounting in do_xmote (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Make recovery error more readable (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark the remaining process-independent glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark flock glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of newlines in log messages (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-129363] - gfs2: Sanitize kthread stopping (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix logd wakeup on I/O error (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_quotad (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_logd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove duplicate check in do_xmote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove space before newline (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix LM_FLAG_TRY* logic in add_to_queue (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove DLM_LKF_ALTCW / DLM_LKF_ALTPR code (Andreas Gruenbacher) [RHEL-129363] - gfs2: Further sanitize lock_dlm.c (Andreas Gruenbacher) [RHEL-129363] - gfs2: sanitize the gdlm_ast -> finish_xmote interface (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify DLM_LKF_QUECVT use (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-129363] - gfs2: Lift withdraw check out of gfs2_ail1_empty (Andreas Gruenbacher) [RHEL-129363] - gfs2: don't withdraw if init_threads() got interrupted (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-129363] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix slab-use-after-free in gfs2_qd_dealloc (Andreas Gruenbacher) [RHEL-129363] {CVE-2023-52760} - gfs2: Fix asynchronous thread destruction (Andreas Gruenbacher) [RHEL-129363] - gfs2: Stop using gfs2_make_fs_ro for withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-129363] - gfs2: Turn gfs2_withdraw into a void function (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark withdraws as unlikely (Andreas Gruenbacher) [RHEL-129363] - gfs2: ignore rindex_update failure in dinode_dealloc (Andreas Gruenbacher) [RHEL-129363] - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270732] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256684] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256684] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256684] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271657] {CVE-2026-93288} - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254282] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-263292] {CVE-2026-89479} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254357] {CVE-2026-74588} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222954] {CVE-2026-52935} - powerpc/pseries: pci - logic bug (Mamatha Inamdar) [RHEL-240146] - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228} - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899] {CVE-2026-90036} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680] {CVE-2026-72262} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641} - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781] {CVE-2026-74583} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916] {CVE-2026-68377} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270905] {CVE-2026-89777} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263644] {CVE-2026-68202} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254200] {CVE-2026-80590} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233134] {CVE-2026-64572} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225459] {CVE-2026-64114} - xfs: bounds-check buffer log item's dirty bitmap (CKI Backport Bot) [RHEL-253365] {CVE-2026-80536} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234242] {CVE-2026-64266} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271288] {CVE-2026-89631} - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280060] {CVE-2026-98320} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271853] {CVE-2026-93817} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191034] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191034] {CVE-2026-53196} - gfs2: a minor finish_xmote cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor run_queue fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: only apply DLM_LKF_VALBLK if sb_lvbptr is not NULL (Alexander Aring) [RHEL-129363] - gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Use wait_event_freezable_timeout() for freezable kthread (Andreas Gruenbacher) [RHEL-129363] - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-129363] - gfs2: low-memory forced flush fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: add missing withdraw locking (Andreas Gruenbacher) [RHEL-129363] - gfs2: Disable GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename "gfs_recovery" workqueue to "gfs2_recovery" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-129363] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-129363] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify do_promote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-129363] - gfs2: introduce new gfs2_glock_assert_withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify refcounting in do_xmote (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Make recovery error more readable (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark the remaining process-independent glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark flock glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of newlines in log messages (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-129363] - gfs2: Sanitize kthread stopping (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix logd wakeup on I/O error (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_quotad (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_logd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove duplicate check in do_xmote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove space before newline (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix LM_FLAG_TRY* logic in add_to_queue (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove DLM_LKF_ALTCW / DLM_LKF_ALTPR code (Andreas Gruenbacher) [RHEL-129363] - gfs2: Further sanitize lock_dlm.c (Andreas Gruenbacher) [RHEL-129363] - gfs2: sanitize the gdlm_ast -> finish_xmote interface (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify DLM_LKF_QUECVT use (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-129363] - gfs2: Lift withdraw check out of gfs2_ail1_empty (Andreas Gruenbacher) [RHEL-129363] - gfs2: don't withdraw if init_threads() got interrupted (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-129363] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix slab-use-after-free in gfs2_qd_dealloc (Andreas Gruenbacher) [RHEL-129363] {CVE-2023-52760} - gfs2: Fix asynchronous thread destruction (Andreas Gruenbacher) [RHEL-129363] - gfs2: Stop using gfs2_make_fs_ro for withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-129363] - gfs2: Turn gfs2_withdraw into a void function (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark withdraws as unlikely (Andreas Gruenbacher) [RHEL-129363] - gfs2: ignore rindex_update failure in dinode_dealloc (Andreas Gruenbacher) [RHEL-129363] - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270732] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256684] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256684] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256684] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271657] {CVE-2026-93288} - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254282] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-263292] {CVE-2026-89479} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254357] {CVE-2026-74588} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222954] {CVE-2026-52935} - powerpc/pseries: pci - logic bug (Mamatha Inamdar) [RHEL-240146] - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228} - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899] {CVE-2026-90036} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680] {CVE-2026-72262} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641} - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781] {CVE-2026-74583} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916] {CVE-2026-68377} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - [rt] build kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 [RHEL-53529] - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071} - [rt] build kernel-rt-4.18.0-553.21.1.rt7.362.el8_10 [RHEL-53529] - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874] - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558} - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441} - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904} - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322} - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246} - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008} - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228} - [rt] build kernel-rt-4.18.0-553.20.1.rt7.361.el8_10 [RHEL-53529] - KVM: arm64: Disassociate vcpus from redistributor region on teardown (Shaoqin Huang) [RHEL-48417] {CVE-2024-40989} - devres: Fix memory leakage caused by driver API devm_free_percpu() (CKI Backport Bot) [RHEL-55597] {CVE-2024-43871} - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (Izabela Bakollari) [RHEL-26680] {CVE-2024-26600} - nvmet-fc: avoid deadlock on delete association path (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - nvmet-fc: release reference on target port (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - ACPI: LPIT: Avoid u32 multiplication overflow (Mark Langsdorf) [RHEL-37062] {CVE-2023-52683} - sched/deadline: Fix task_struct reference leak (Phil Auld) [RHEL-50904] {CVE-2024-41023} - nfsd: fix crash on LOCKT on reexported NFSv3 (Benjamin Coddington) [RHEL-31515] - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path (CKI Backport Bot) [RHEL-26570] {CVE-2024-26595} - mlxsw: spectrum_acl_tcam: Move devlink param to TCAM code (Ivan Vecera) [RHEL-26570] {CVE-2024-26595} - ACPI: extlog: fix NULL pointer dereference check (Mark Langsdorf) [RHEL-29110] {CVE-2023-52605} - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() (Mark Langsdorf) [RHEL-33198] {CVE-2024-26894} - mm: prevent derefencing NULL ptr in pfn_section_valid() (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - mm, kmsan: fix infinite recursion due to RCU critical section (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - cipso: make cipso_v4_skbuff_delattr() fully remove the CIPSO options (Ondrej Mosnacek) [RHEL-30904] - cipso: fix total option length computation (Ondrej Mosnacek) [RHEL-30904] - ext4: do not create EA inode under buffer lock (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: check the return value of ext4_xattr_inode_dec_ref() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (Carlos Maiolino) [RHEL-48507] {CVE-2024-40998} - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - [rt] build kernel-rt-4.18.0-553.19.1.rt7.360.el8_10 [RHEL-53529] - drm/i915/vma: Fix UAF on destroy against retire race (Mika Penttilä) [RHEL-35222] {CVE-2024-26939} - RHEL-48620 (Kenneth Yin) [RHEL-48620] - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (CKI Backport Bot) [RHEL-42721] {CVE-2024-26855} - net: usb: asix: do not force pause frames support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix "can't send until first packet is send" issue (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix modprobe "sysfs: cannot create duplicate filename" (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: add proper error handling of usb read errors (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix wrong return value in asix_check_host_enable() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix uninit-value in asix_mdio_read() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: fix boolconv.cocci warnings (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: do not call phy_disconnect() for ax88178 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: move embedded PHY detection as early as possible (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix uninit value bugs (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add missing stop (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: suspend PHY on driver probe (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: manage PHY PM from MAC (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: add error handling for asix_mdio_* functions (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add phylib support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: refactor asix_read_phy_addr() and handle errors on return (Ken Cox) [RHEL-28108] {CVE-2021-47101} - SUNRPC: always free ctxt when freeing deferred request (Jay Shin) [RHEL-40936] - SUNRPC: double free xprt_ctxt while still in use (Jay Shin) [RHEL-40936] - SUNRPC: Remove svc_rqst::rq_xprt_hlen (Jay Shin) [RHEL-40936] - SUNRPC: Remove dead code in svc_tcp_release_rqst() (Jay Shin) [RHEL-40936] - x86/bugs: Extend VMware Retbleed workaround to Nehalem & earlier CPUs (Waiman Long) [RHEL-48646] - wifi: iwlwifi: read txq->read_ptr under lock (Jose Ignacio Tornos Martinez) [RHEL-39797] {CVE-2024-36922} - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (John Meneghini) [RHEL-39908] {CVE-2024-36919} - nbd: always initialize struct msghdr completely (Ming Lei) [RHEL-29498] {CVE-2024-26638} - block: don't call rq_qos_ops->done_bio if the bio isn't tracked (Ming Lei) [RHEL-42151] {CVE-2021-47412} - nvmet: fix a possible leak when destroy a ctrl during qp establishment (Maurizio Lombardi) [RHEL-52013] {CVE-2024-42152} - ipv6: prevent NULL dereference in ip6_output() (Sabrina Dubroca) [RHEL-39912] {CVE-2024-36901} - ppp: reject claimed-as-LCP but actually malformed packets (Guillaume Nault) [RHEL-51052] {CVE-2024-41044} - leds: trigger: Unregister sysfs attributes before calling deactivate() (CKI Backport Bot) [RHEL-54834] {CVE-2024-43830} - crypto: bcm - Fix pointer arithmetic (cki-backport-bot) [RHEL-44108] {CVE-2024-38579} - scsi: qedf: Ensure the copied buf is NUL terminated (John Meneghini) [RHEL-44195] {CVE-2024-38559} - x86/bhi: Avoid warning in #DB handler due to BHI mitigation (Waiman Long) [RHEL-53657] {CVE-2024-42240} - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (CKI Backport Bot) [RHEL-47529] {CVE-2024-40901} - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (CKI Backport Bot) [RHEL-39843] {CVE-2024-36902} - net: usb: ax88179_178a: improve link status logs (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: improve reset check (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: fix link status when link is set to down/up (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: avoid writing the mac address before first reading (Jose Ignacio Tornos Martinez) [RHEL-45167] - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - media: cec: cec-api: add locking in cec_release() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid confusing "transmit timed out" message (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid recursive cec_claim_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: remove length check of Timer Status (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: count low-drive, error and arb-lost conditions (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add note about *_from_edid() function usage in drm (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_unconfigured() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_nb_transmit_canceled() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: don't set last_initiator if tx in progress (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: disable adapter in cec_devnode_unregister (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: not all messages were passed on when monitoring (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add support for Absolute Volume Control (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: log when claiming LA fails unexpectedly (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: drop activate_cnt, use state info instead (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: reconfigure if the PA changes during configuration (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: fix is_configuring state (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: stop trying LAs on CEC_TX_STATUS_TIMEOUT (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't unconfigure if already unconfigured (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add optional adap_configured callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add xfer_timeout_ms field (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: use call_op and check for !unregistered (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix interrupt en/disable handling (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: drop unused 'enabled' field from struct cec_pin (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix off-by-one SFT check (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: rename timer overrun variables (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: correctly pass on reply results (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: abort if the current transmit was canceled (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: call enable_adap on s_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: media/cec.h: document cec_adapter fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix a deadlock situation (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: safely unhook lists in cec_data (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: copy sequence field for the reply (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix trivial style warnings (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: add 'unregistered' checks (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't use flush_scheduled_work() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: Use fallthrough pseudo-keyword (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: remove unused waitq and phys_addrs fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: silence shift wrapping warning in __cec_s_log_addrs() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: move the core to a separate directory (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - net/iucv: Avoid explicit cpumask var allocation on stack (CKI Backport Bot) [RHEL-51631] {CVE-2024-42094} - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (Dick Kennedy) [RHEL-40400] - KVM: selftests: Make hyperv_clock require TSC based system clocksource (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Run clocksource dependent tests with hyperv_clocksource_tsc_page too (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Use generic sys_clocksource_is_tsc() in vmx_nested_tsc_scaling_test (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Generalize check_clocksource() from kvm_clock_test (Vitaly Kuznetsov) [RHEL-19027] - firmware: cs_dsp: Return error if block header overflows file (CKI Backport Bot) [RHEL-53646] {CVE-2024-42238} - firmware: cs_dsp: Validate payload length before processing block (CKI Backport Bot) [RHEL-53638] {CVE-2024-42237} - mm, slub: fix potential memoryleak in kmem_cache_open() (Waiman Long) [RHEL-38404] {CVE-2021-47466} - slub: don't panic for memcg kmem cache creation failure (Waiman Long) [RHEL-38404] {CVE-2021-47466} - wifi: ath11k: fix htt pktlog locking (Jose Ignacio Tornos Martinez) [RHEL-38317] {CVE-2023-52800} - wifi: ath11k: fix dfs radar event locking (Jose Ignacio Tornos Martinez) [RHEL-38165] {CVE-2023-52798} - lib/generic-radix-tree.c: Don't overflow in peek() (Waiman Long) [RHEL-37737] {CVE-2021-47432} - include/linux/generic-radix-tree.h: replace kernel.h with the necessary inclusions (Waiman Long) [RHEL-37737] {CVE-2021-47432} - EDAC/i10nm: Skip the absent memory controllers (Aristeu Rozanski) [RHEL-43236] - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (John Meneghini) [RHEL-38197] {CVE-2023-52809} - gfs2: Fix potential glock use-after-free on unmount (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: simplify gdlm_put_lock with out_free label (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: Remove ill-placed consistency check (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - nvme-fc: do not wait in vain when unloading module (Ewan D. Milne) [RHEL-33083] {CVE-2024-26846} - HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts (CKI Backport Bot) [RHEL-49698] {CVE-2022-48866} - scsi: qedf: Set qed_slowpath_params to zero before use (John Meneghini) [RHEL-9797] - scsi: qedf: Wait for stag work during unload (John Meneghini) [RHEL-9797] - scsi: qedf: Don't process stag work during unload and recovery (John Meneghini) [RHEL-9797] - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - mm: avoid overflows in dirty throttling logic (Audra Mitchell) [RHEL-51840] {CVE-2024-42131} - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - ACPI: fix NULL pointer dereference (Mark Langsdorf) [RHEL-37897] {CVE-2021-47289} - [rt] build kernel-rt-4.18.0-553.18.1.rt7.359.el8_10 [RHEL-53529] - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING (Ewan D. Milne) [RHEL-39805] {CVE-2024-36920} - tun: limit printing rate when illegal packet received by tun dev (Jon Maloy) [RHEL-35046] {CVE-2024-27013} - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu/mes: fix use-after-free issue (Michel Dänzer) [RHEL-44043] {CVE-2024-38581} - drm/amdgpu: Fix the null pointer when load rlc firmware (Michel Dänzer) [RHEL-30603] {CVE-2024-26649} - drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (Michel Dänzer) [RHEL-35160] {CVE-2024-27042} - net/sched: Fix UAF when resolving a clash (Xin Long) [RHEL-51014] {CVE-2024-41040} - tcp_metrics: validate source addr length (Guillaume Nault) [RHEL-52025] {CVE-2024-42154} - NFSv4/pnfs: Fix a use-after-free bug in open (Benjamin Coddington) [RHEL-35508] - NFSv4: Don't hold the layoutget locks across multiple RPC calls (Benjamin Coddington) [RHEL-35508] - scsi: qedf: Make qedf_execute_tmf() non-preemptible (John Meneghini) [RHEL-51799] {CVE-2024-42124} - Input: elantech - fix stack out of bound access in elantech_change_report_id() (CKI Backport Bot) [RHEL-41938] {CVE-2021-47097} - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (CKI Backport Bot) [RHEL-28982] {CVE-2023-52478} - drm/radeon: fix UBSAN warning in kv_dpm.c (CKI Backport Bot) [RHEL-48399] {CVE-2024-40988} - usb: core: Don't hold the device lock while sleeping in do_proc_control() (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - USB: core: Make do_proc_control() and do_proc_bulk() killable (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - scsi: qedi: Fix crash while reading debugfs attribute (CKI Backport Bot) [RHEL-48327] {CVE-2024-40978} - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CKI Backport Bot) [RHEL-48309] {CVE-2024-40977} - net: tcp: accept old ack during closing (Jamie Bainbridge) [RHEL-52433] - wifi: iwlwifi: mvm: don't read past the mfuart notifcation (CKI Backport Bot) [RHEL-48016] {CVE-2024-40941} - net/iucv: fix use after free in iucv_sock_close() (Mete Durlu) [RHEL-53988] - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (CKI Backport Bot) [RHEL-47908] {CVE-2024-40929} - Input: aiptek - properly check endpoint type (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - use descriptors of current altsetting (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - fix endpoint sanity check (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB (CKI Backport Bot) [RHEL-52373] {CVE-2024-42226} - wifi: mt76: replace skb_put with skb_put_zero (CKI Backport Bot) [RHEL-52366] {CVE-2024-42225} - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (CKI Backport Bot) [RHEL-47776] {CVE-2024-40912} - wifi: cfg80211: Lock wiphy in cfg80211_get_station (CKI Backport Bot) [RHEL-47758] {CVE-2024-40911} - VMCI: Use struct_size() in kmalloc() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() (Steve Best) [RHEL-37325] {CVE-2024-35944} - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values (Jose Ignacio Tornos Martinez) [RHEL-51761] {CVE-2024-42114} - usb: atm: cxacru: fix endpoint checking in cxacru_bind() (CKI Backport Bot) [RHEL-51442] {CVE-2024-41097} - nfs: handle error of rpc_proc_register() in init_nfs_fs() (Scott Mayhew) [RHEL-39904] {CVE-2024-36939} - drm/radeon: check bo_va->bo is non-NULL before using it (CKI Backport Bot) [RHEL-51184] {CVE-2024-41060} - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). (CKI Backport Bot) [RHEL-51027] {CVE-2024-41041} - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (CKI Backport Bot) [RHEL-50961] {CVE-2024-41035} - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). (CKI Backport Bot) [RHEL-44408] {CVE-2024-37356} - tcp: avoid too many retransmit packets (Florian Westphal) [RHEL-48627] {CVE-2024-41007} - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() (Florian Westphal) [RHEL-48627] - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Florian Westphal) [RHEL-48627] - tcp: refactor tcp_retransmit_timer() (Florian Westphal) [RHEL-48627] - tcp: exit if nothing to retransmit on RTO timeout (Florian Westphal) [RHEL-48627] - netfilter: nf_tables: Reject tables of unsupported family (Florian Westphal) [RHEL-21418] {CVE-2023-6040} - [rt] build kernel-rt-4.18.0-553.17.1.rt7.358.el8_10 [RHEL-53529] - kyber: fix out of bounds access when preempted (Ming Lei) [RHEL-27258] {CVE-2021-46984} - vfs: don't mod negative dentry count when on shrinker list (Brian Foster) [RHEL-35874] - fs/dcache: Re-use value stored to dentry->d_flags instead of re-reading (Brian Foster) [RHEL-35874] - fbmem: Do not delete the mode that is still in use (CKI Backport Bot) [RHEL-37796] {CVE-2021-47338} - netpoll: Fix race condition in netpoll_owner_active (CKI Backport Bot) [RHEL-49361] {CVE-2024-41005} - firmware: arm_scpi: Fix string overflow in SCPI genpd driver (Mark Salter) [RHEL-43702] {CVE-2021-47609} - ipv6: prevent possible NULL dereference in rt6_probe() (Guillaume Nault) [RHEL-48149] {CVE-2024-40960} - HID: i2c-hid-of: fix NULL-deref on failed power up (CKI Backport Bot) [RHEL-31598] {CVE-2024-26717} - cpufreq: amd-pstate: fix memory leak on CPU EPP exit (CKI Backport Bot) [RHEL-48489] {CVE-2024-40997} - x86/mm/pat: fix VM_PAT handling in COW mappings (Chris von Recklinghausen) [RHEL-37258] {CVE-2024-35877} - PCI/PM: Drain runtime-idle callbacks before driver removal (Myron Stowe) [RHEL-42937] {CVE-2024-35809} - PCI: Drop pci_device_remove() test of pci_dev->driver (Myron Stowe) [RHEL-42937] {CVE-2024-35809} - drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() (Mika Penttilä) [RHEL-26909] {CVE-2023-52470} - USB: core: Fix hang in usb_kill_urb by adding memory barriers (Desnes Nunes) [RHEL-43979] {CVE-2022-48760} - cifs: fix bad fids sent over wire (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB311_posix_mkdir (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB2_tcon (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB2_open (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB2_ioctl (Paulo Alcantara) [RHEL-52517] - selftests: forwarding: devlink_lib: Wait for udev events after reloading (Mark Langsdorf) [RHEL-47642] {CVE-2024-39501} - drivers: core: synchronize really_probe() and dev_uevent() (Mark Langsdorf) [RHEL-47642] {CVE-2024-39501} - udp: do not accept non-tunnel GSO skbs landing in a tunnel (Xin Long) [RHEL-42997] {CVE-2024-35884} - filelock: Remove locks reliably when fcntl/close race is detected (Bill O'Donnell) [RHEL-50170] {CVE-2024-41012} - Input: add bounds checking to input_set_capability() (Benjamin Tissoires) [RHEL-21413] {CVE-2022-48619} - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() (CKI Backport Bot) [RHEL-48130] {CVE-2024-40959} - blk-cgroup: fix list corruption from reorder of WRITE ->lqueued (Ming Lei) [RHEL-33695] - blk-cgroup: fix list corruption from resetting io stat (Ming Lei) [RHEL-33695] - net: do not leave a dangling sk pointer, when socket creation fails (CKI Backport Bot) [RHEL-48060] {CVE-2024-40954} - perf/x86/lbr: Filter vsyscall addresses (Michael Petlan) [RHEL-28991] {CVE-2023-52476} - vmci: prevent speculation leaks by sanitizing event in event_deliver() (CKI Backport Bot) [RHEL-47678] {CVE-2024-39499} - serial: core: fix transmit-buffer reset and memleak (Steve Best) [RHEL-38731] {CVE-2021-47527} - powerpc/pseries: Whitelist dtl slub object for copying to userspace (Mamatha Inamdar) [RHEL-51236] {CVE-2024-41065} - powerpc/eeh: avoid possible crash when edev->pdev changes (Mamatha Inamdar) [RHEL-51220] {CVE-2024-41064} - x86: stop playing stack games in profile_pc() (Steve Best) [RHEL-51643] {CVE-2024-42096} - mptcp: ensure snd_una is properly initialized on connect (Florian Westphal) [RHEL-47933 RHEL-47934] {CVE-2024-40931} - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet (CKI Backport Bot) [RHEL-47492] {CVE-2024-39506} - tun: add missing verification for short frame (Patrick Talbert) [RHEL-50194] {CVE-2024-41091} - tap: add missing verification for short frame (Patrick Talbert) [RHEL-50279] {CVE-2024-41090} - usb-storage: alauda: Check whether the media is initialized (Desnes Nunes) [RHEL-43708] {CVE-2024-38619} - usb-storage: alauda: Fix uninit-value in alauda_check_media() (Desnes Nunes) [RHEL-43708] {CVE-2024-38619} - hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37723] {CVE-2021-47384} - block: fix that util can be greater than 100% (Ming Lei) [RHEL-23074] - block: support to account io_ticks precisely (Ming Lei) [RHEL-23074] - watchdog: Fix possible use-after-free by calling del_timer_sync() (Steve Best) [RHEL-38795] {CVE-2021-47321} - hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37719] {CVE-2021-47385} - mlxsw: spectrum: Protect driver from buggy firmware (CKI Backport Bot) [RHEL-42245] {CVE-2021-47560} - mlxsw: Verify the accessed index doesn't exceed the array length (CKI Backport Bot) [RHEL-42245] {CVE-2021-47560} - dm: call the resume method on internal suspend (Benjamin Marzinski) [RHEL-41835] {CVE-2024-26880} - tty: Fix out-of-bound vmalloc access in imageblit (Steve Best) [RHEL-37727] {CVE-2021-47383} - hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37715] {CVE-2021-47386} - hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs (Steve Best) [RHEL-37710] {CVE-2021-47393} - nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells (Steve Best) [RHEL-38436] {CVE-2021-47497} - driver core: auxiliary bus: Fix memory leak when driver_register() fail (Steve Best) [RHEL-37901] {CVE-2021-47287} - phylib: fix potential use-after-free (cki-backport-bot) [RHEL-43764] {CVE-2022-48754} - ptp: Fix possible memory leak in ptp_clock_register() (Hangbin Liu) [RHEL-38424] {CVE-2021-47455} - NFSv4: Fix memory leak in nfs4_set_security_label (CKI Backport Bot) [RHEL-51315] {CVE-2024-41076} - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER (CKI Backport Bot) [RHEL-51618] {CVE-2024-42090} - ftruncate: pass a signed offset (CKI Backport Bot) [RHEL-51598] {CVE-2024-42084} - af_unix: Fix garbage collector racing against connect() (Felix Maurer) [RHEL-34225] {CVE-2024-26923} - virtio-net: Add validation for used length (Laurent Vivier) [RHEL-42080] {CVE-2021-47352} - net: fix possible store tearing in neigh_periodic_work() (Antoine Tenart) [RHEL-42359] {CVE-2023-52522} - tunnels: fix out of bounds access when building IPv6 PMTU error (Antoine Tenart) [RHEL-41823] {CVE-2024-26665} - vt_ioctl: fix array_index_nospec in vt_setactivate (John W. Linville) [RHEL-49141] {CVE-2022-48804} - Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() (CKI Backport Bot) [RHEL-38302] {CVE-2023-52840} - netns: Make get_net_ns() handle zero refcount net (Antoine Tenart) [RHEL-48105] {CVE-2024-40958} - tracing: Ensure visibility when inserting an element into tracing_map (Michael Petlan) [RHEL-30457] {CVE-2024-26645} - KVM: s390: fix LPSWEY handling (CKI Backport Bot) [RHEL-50072] - firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files (CKI Backport Bot) [RHEL-51144] {CVE-2024-41056} - SUNRPC: Fix a race to wake a sync task (Benjamin Coddington) [RHEL-11843] - firmware: cs_dsp: Fix overflow checking of wmfw header (CKI Backport Bot) [RHEL-50999] {CVE-2024-41039} - firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers (CKI Backport Bot) [RHEL-50987] {CVE-2024-41038} - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (Xin Long) [RHEL-48471] {CVE-2024-40995} - net: fix out-of-bounds access in ops_init (Xin Long) [RHEL-43185] {CVE-2024-36883} - x86/mce/therm_throt: Undo thermal polling properly on CPU offline (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Do not access uninitialized therm_work (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Mark throttle_active_work() as __maybe_unused (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Mask out read-only and reserved MSR bits (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Optimize notifications of thermal throttle (Steve Best) [RHEL-45310] - jiffies: add utility function to calculate delta in ms (Steve Best) [RHEL-45310] - x86/mce: Lower throttling MCE messages' priority to warning (Steve Best) [RHEL-45310] - dmaengine: idxd: Fix oops during rmmod on single-CPU platforms (Eder Zulian) [RHEL-37361] {CVE-2024-35989} - xfs: don't walk off the end of a directory data block (CKI Backport Bot) [RHEL-50879] {CVE-2024-41013} - xfs: add bounds checking to xlog_recover_process_data (CKI Backport Bot) [RHEL-50856] {CVE-2024-41014} - dm-crypt: limit the size of encryption requests (Benjamin Marzinski) [RHEL-29330] - netfilter: flowtable: remove nf_ct_l4proto_find() call (Florian Westphal) [RHEL-49589] - [rt] build kernel-rt-4.18.0-553.16.1.rt7.357.el8_10 [RHEL-44553] - x86/bhi: Fix incorrect CLEAR_BRANCH_HISTORY position in entry_INT80_compat (Waiman Long) [RHEL-50648] - [rt] build kernel-rt-4.18.0-553.15.1.rt7.356.el8_10 [RHEL-44553] - Revert "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-44613] - ionic: fix use after netif_napi_del() (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - ionic: clean interrupt before enabling queue to avoid credit race (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change (CKI Backport Bot) [RHEL-49321] {CVE-2021-47624} - xhci: Handle TD clearing for multiple streams case (CKI Backport Bot) [RHEL-47882] {CVE-2024-40927} - net: openvswitch: Fix Use-After-Free in ovs_ct_exit (cki-backport-bot) [RHEL-36362] {CVE-2024-27395} - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: fix vlan use-after-free (cki-backport-bot) [RHEL-43721] {CVE-2024-36979} - irqchip/gic-v3-its: Prevent double free on error (Charles Mirabile) [RHEL-37022] {CVE-2024-35847} - irqchip/gic-v3-its: Fix potential VPE leak on error (Charles Mirabile) [RHEL-37744] {CVE-2021-47373} - i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() (Charles Mirabile) [RHEL-34735] {CVE-2022-48632} - iommu/dma: fix zeroing of bounce buffer padding used by untrusted devices (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: remove alloc_size argument to swiotlb_tbl_map_single() (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: fix swiotlb_bounce() to do partial sync's correctly (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Reinstate page-alignment for mappings >= PAGE_SIZE (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix alignment checks when both allocation and DMA masks are present (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix double-allocation of slots due to broken alignment handling (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (cki-backport-bot) [RHEL-44441] {CVE-2024-31076} - [rt] build kernel-rt-4.18.0-553.14.1.rt7.355.el8_10 [RHEL-44553] - s390/qeth: Fix kernel panic after setting hsuid (Mete Durlu) [RHEL-49754] - perf/core: Protect event sibling list locking against interrupt inversion (Daniel Vacek) [RHEL-31798] - vt: fix unicode buffer corruption when deleting characters (Steve Best) [RHEL-36936] {CVE-2024-35823} - cifs: translate network errors on send to -ECONNABORTED (Paulo Alcantara) [RHEL-36754] - xfs: don't block in busy flushing when freeing extents (Brian Foster) [RHEL-7984] - xfs: allow extent free intents to be retried (Brian Foster) [RHEL-7984] - xfs: pass alloc flags through to xfs_extent_busy_flush() (Brian Foster) [RHEL-7984] - xfs: use deferred frees for btree block freeing (Brian Foster) [RHEL-7984] - xfs: fix bounds check in xfs_defer_agfl_block() (Brian Foster) [RHEL-7984] - xfs: validate block number being freed before adding to xefi (Brian Foster) [RHEL-7984] - xfs: rename xfs_bmap_add_free to xfs_free_extent_later (Brian Foster) [RHEL-7984] - usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (Desnes Nunes) [RHEL-36803] {CVE-2024-35790} - stm class: Fix a double free in stm_register_device() (Steve Best) [RHEL-44514] {CVE-2024-38627} - s390/qeth: Fix potential loss of L3-IP@ in case of network issues (Mete Durlu) [RHEL-49755] - tls: fix missing memory barrier in tls_init (cki-backport-bot) [RHEL-44471] {CVE-2024-36489} - xfs: fix log recovery buffer allocation for the legacy h_size fixup (Bill O'Donnell) [RHEL-46473] {CVE-2024-39472} - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: use __for_each_thread() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - exit: Use the correct exit_code in /proc/<pid>/stat (Brian Foster) [RHEL-31562] {CVE-2024-26686} - scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool (Ewan D. Milne) [RHEL-38283] {CVE-2023-52811} - scsi: qla2xxx: Fix double free of fcport (Ewan D. Milne) [RHEL-39549] {CVE-2024-26929} - scsi: qla2xxx: Fix double free of the ha->vp_map pointer (Ewan D. Milne) [RHEL-39549] {CVE-2024-26930} - scsi: qla2xxx: Fix command flush on cable pull (Ewan D. Milne) [RHEL-39549] {CVE-2024-26931} - [rt] build kernel-rt-4.18.0-553.13.1.rt7.354.el8_10 [RHEL-44553] - redhat: remove handling of deleted rhdocs/ directory from genspec.sh (Denys Vlasenko) - x86/bugs: Fix BHI retpoline check (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI handling of RRSBA (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr' (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI documentation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix return type of spectre_bhi_state() (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Make CONFIG_SPECTRE_BHI_ON the default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Mitigate KVM by default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add BHI mitigation knob (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Enumerate Branch History Injection (BHI) bug (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Define SPEC_CTRL_BHI_DIS_S (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add support for clearing branch history at syscall entry (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file (Waiman Long) [RHEL-28202] - perf/x86/amd/lbr: Use freeze based on availability (Waiman Long) [RHEL-28202] - Documentation/kernel-parameters: Add spec_rstack_overflow to mitigations=off (Waiman Long) [RHEL-28202] - KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace (Waiman Long) [RHEL-28202] - x86/bugs: Reset speculation control settings on init (Waiman Long) [RHEL-28202] - KVM: x86: Update KVM-only leaf handling to allow for 100% KVM-only leafs (Waiman Long) [RHEL-28202] - KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest (Waiman Long) [RHEL-28202] - mptcp: ensure snd_nxt is properly initialized on connect (Davide Caratti) [RHEL-39865] {CVE-2024-36889} - powerpc/pseries: Enforce hcall result buffer validity and size (Mamatha Inamdar) [RHEL-48291] {CVE-2024-40974} - wifi: mac80211: fix potential key use-after-free (Jose Ignacio Tornos Martinez) [RHEL-28007] {CVE-2023-52530} - cppc_cpufreq: Fix possible null pointer dereference (Mark Langsdorf) [RHEL-44137] {CVE-2024-38573} - net/sched: act_mirred: use the backlog for mirred ingress (Davide Caratti) [RHEL-31718] {CVE-2024-26740} - vfio/pci: Lock external INTx masking ops (Alex Williamson) [RHEL-31922] {CVE-2024-26810} - net: sched: sch_multiq: fix possible OOB write in multiq_tune() (Davide Caratti) [RHEL-43464] {CVE-2024-36978} - tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized (Guillaume Nault) [RHEL-37850] {CVE-2021-47304} - pstore/ram: Fix crash when setting number of cpus to an odd number (Lenny Szubowicz) [RHEL-29471] {CVE-2023-52619} - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node (Jocelyn Falempe) [RHEL-37101] {CVE-2023-52662} - drm/vmwgfx: Fix the lifetime of the bo cursor memory (Jocelyn Falempe) [RHEL-36962] {CVE-2024-35810} - drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed (Jocelyn Falempe) [RHEL-34987] {CVE-2024-26940} - drm/vmwgfx: Unmap the surface before resetting it on a plane state (Jocelyn Falempe) [RHEL-35217] {CVE-2023-52648} - drm/vmwgfx: Fix invalid reads in fence signaled events (Jocelyn Falempe) [RHEL-40010] {CVE-2024-36960} - block: Fix wrong offset in bio_truncate() (Ming Lei) [RHEL-43782] {CVE-2022-48747} - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CKI Backport Bot) [RHEL-46913] {CVE-2024-39487} - net: fix __dst_negative_advice() race (Xin Long) [RHEL-41183] {CVE-2024-36971} - igc: avoid returning frame twice in XDP_REDIRECT (Corinna Vinschen) [RHEL-33264] {CVE-2024-26853} - mac802154: fix llsec key resources release in mac802154_llsec_key_del (Steve Best) [RHEL-34967] {CVE-2024-26961} - cpufreq: exit() callback is optional (Mark Langsdorf) [RHEL-43840] {CVE-2024-38615} - cifs: prevent infinite recursion in CIFSGetDFSRefer() (Paulo Alcantara) [RHEL-34672] - cifs: lock chan_lock outside match_session (Paulo Alcantara) [RHEL-34672] - smb3: workaround negprot bug in some Samba servers (Paulo Alcantara) [RHEL-34672] - smb3: use netname when available on secondary channels (Paulo Alcantara) [RHEL-34672] - smb3: fix empty netname context on secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: populate empty hostnames for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: always iterate smb sessions using primary channel (Paulo Alcantara) [RHEL-34672] - cifs: Fix connections leak when tlink setup failed (Paulo Alcantara) [RHEL-34672] - cifs: Fix memory leak when build ntlmssp negotiate blob failed (Paulo Alcantara) [RHEL-34672] - cifs: always initialize struct msghdr smb_msg completely (Paulo Alcantara) [RHEL-34672] - cifs: don't send down the destination address to sendmsg for a SOCK_STREAM (Paulo Alcantara) [RHEL-34672] - cifs: revalidate mapping when doing direct writes (Paulo Alcantara) [RHEL-34672] - cifs: skip extra NULL byte in filenames (Paulo Alcantara) [RHEL-34672] - cifs: list_for_each() -> list_for_each_entry() (Paulo Alcantara) [RHEL-34672] - smb2: small refactor in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - cifs: Fix crash on unload of cifs_arc4.ko (Paulo Alcantara) [RHEL-34672] - cifs: remove check of list iterator against head past the loop body (Paulo Alcantara) [RHEL-34672] - cifs: fix reconnect on smb3 mount types (Paulo Alcantara) [RHEL-34672] - cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (Paulo Alcantara) [RHEL-34672] - cifs: skip trailing separators of prefix paths (Paulo Alcantara) [RHEL-34672] - cifs: fix ntlmssp on old servers (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL ptr dereference in refresh_mounts() (Paulo Alcantara) [RHEL-34672] - cifs: do not skip link targets when an I/O fails (Paulo Alcantara) [RHEL-34672] - cifs: fix confusing unneeded warning message on smb2.1 and earlier (Paulo Alcantara) [RHEL-34672] - smb3: fix snapshot mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix workstation_name for multiuser mounts (Paulo Alcantara) [RHEL-34672] - cifs: alloc_path_with_tree_prefix: do not append sep. if the path is empty (Paulo Alcantara) [RHEL-34672] - cifs: free ntlmsspblob allocated in negotiate (Paulo Alcantara) [RHEL-34672] - cifs: avoid use of dstaddr as key for fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: add server conn_id to fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: fix missed refcounting of ipc tcon (Paulo Alcantara) [RHEL-34672] - smb2: clarify rc initialization in smb2_reconnect (Paulo Alcantara) [RHEL-34672] - cifs: populate server_hostname for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should be set on new server (Paulo Alcantara) [RHEL-34672] - cifs: introduce cifs_ses_mark_for_reconnect() helper (Paulo Alcantara) [RHEL-34672] - cifs: protect srv_count with cifs_tcp_ses_lock (Paulo Alcantara) [RHEL-34672] - cifs: move debug print out of spinlock (Paulo Alcantara) [RHEL-34672] - cifs: do not duplicate fscache cookie for secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: connect individual channel servers to primary channel server (Paulo Alcantara) [RHEL-34672] - cifs: protect session channel fields with chan_lock (Paulo Alcantara) [RHEL-34672] - cifs: do not negotiate session if session already exists (Paulo Alcantara) [RHEL-34672] - smb3: do not setup the fscache_super_cookie until fsinfo initialized (Paulo Alcantara) [RHEL-34672] - cifs: fix potential use-after-free bugs (Paulo Alcantara) [RHEL-34672] - cifs: release lock earlier in dequeue_mid error case (Paulo Alcantara) [RHEL-34672] - smb3: remove trivial dfs compile warning (Paulo Alcantara) [RHEL-34672] - cifs: support nested dfs links over reconnect (Paulo Alcantara) [RHEL-34672] - cifs: for compound requests, use open handle if possible (Paulo Alcantara) [RHEL-34672] - cifs: split out dfs code from cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant (Paulo Alcantara) [RHEL-34672] - cifs: introduce new helper for cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: fix print of hdr_flags in dfscache_proc_show() (Paulo Alcantara) [RHEL-34672] - cifs: send workstation name during ntlmssp session setup (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should not share socket with future sessions (Paulo Alcantara) [RHEL-34672] - smb3: add dynamic trace points for socket connection (Paulo Alcantara) [RHEL-34672] - cifs: Move SMB2_Create definitions to the shared area (Paulo Alcantara) [RHEL-34672] - cifs: Move more definitions into the shared area (Paulo Alcantara) [RHEL-34672] - cifs: move NEGOTIATE_PROTOCOL definitions out into the common area (Paulo Alcantara) [RHEL-34672] - cifs: Create a new shared file holding smb2 pdu definitions (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect check for null pointer in header_assemble (Paulo Alcantara) [RHEL-34672] - smb3: correct server pointer dereferencing check to be more consistent (Paulo Alcantara) [RHEL-34672] - cifs: Deal with some warnings from W=1 (Paulo Alcantara) [RHEL-34672] - cifs: fix a sign extension bug (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect kernel doc comments (Paulo Alcantara) [RHEL-34672] - cifs: remove pathname for file from SPDX header (Paulo Alcantara) [RHEL-34672] - cifs: move SMB FSCTL definitions to common code (Paulo Alcantara) [RHEL-34672] - cifs: rename cifs_common to smbfs_common (Paulo Alcantara) [RHEL-34672] - cifs: update FSCTL definitions (Paulo Alcantara) [RHEL-34672] - cifs: cifs_md4 convert to SPDX identifier (Paulo Alcantara) [RHEL-34672] - cifs: create a MD4 module and switch cifs.ko to use it (Paulo Alcantara) [RHEL-34672] - cifs: fork arc4 and create a separate module for it for cifs and other users (Paulo Alcantara) [RHEL-34672] - smb3: fix posix extensions mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix wrong release in sess_alloc_buffer() failed path (Paulo Alcantara) [RHEL-34672] - CIFS: Fix a potencially linear read overflow (Paulo Alcantara) [RHEL-34672] - cifs: use the correct max-length for dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: create sd context must be a multiple of 8 (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp sessions of dfs connections (Paulo Alcantara) [RHEL-34672] - cifs: added WARN_ON for all the count decrements (Paulo Alcantara) [RHEL-34672] - cifs: fix missing null session check in mount (Paulo Alcantara) [RHEL-34672] - cifs: handle reconnect of tcon when there is no cached dfs referral (Paulo Alcantara) [RHEL-34672] - cifs: fix the out of range assignment to bit fields in parse_server_interfaces (Paulo Alcantara) [RHEL-34672] - smb3: fix typo in header file (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: Add support for negotiating signing algorithm (Paulo Alcantara) [RHEL-34672] - cifs: prevent NULL deref in cifs_compose_mount_options() (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL dereference in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - smbdirect: missing rc checks while waiting for rdma events (Paulo Alcantara) [RHEL-34672] - cifs: Avoid field over-reading memcpy() (Paulo Alcantara) [RHEL-34672] - smb311: remove dead code for non compounded posix query info (Paulo Alcantara) [RHEL-34672] - cifs: fix SMB1 error path in cifs_get_file_info_unix (Paulo Alcantara) [RHEL-34672] - smb3: fix uninitialized value for port in witness protocol move (Paulo Alcantara) [RHEL-34672] - cifs: fix unneeded null check (Paulo Alcantara) [RHEL-34672] - cifs: use SPDX-Licence-Identifier (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in cifs_debug.c (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in smb2misc.c (Paulo Alcantara) [RHEL-34672] - cifs: missed ref-counting smb session in find (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp servers with dfs mounts (Paulo Alcantara) [RHEL-34672] - cifs: set a minimum of 2 minutes for refreshing dfs cache (Paulo Alcantara) [RHEL-34672] - cifs: Remove unused inline function is_sysvol_or_netlogon() (Paulo Alcantara) [RHEL-34672] - cifs: remove duplicated prototype (Paulo Alcantara) [RHEL-34672] - cifs: fix ipv6 formating in cifs_ses_add_channel (Paulo Alcantara) [RHEL-34672] - cifs: fix string declarations and assignments in tracepoints (Paulo Alcantara) [RHEL-34672] - cifs: fix memory leak in smb2_copychunk_range (Paulo Alcantara) [RHEL-34672] - SMB3: incorrect file id in requests compounded with open (Paulo Alcantara) [RHEL-34672] - smb3: if max_channels set to more than one channel request multichannel (Paulo Alcantara) [RHEL-34672] - smb3: do not attempt multichannel to server which does not support it (Paulo Alcantara) [RHEL-34672] - smb3: when mounting with multichannel include it in requested capabilities (Paulo Alcantara) [RHEL-34672] - cifs: simplify SWN code with dummy funcs instead of ifdefs (Paulo Alcantara) [RHEL-34672] - cifs: log mount errors using cifs_errorf() (Paulo Alcantara) [RHEL-34672] - cifs: switch build_path_from_dentry() to using dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: fix out-of-bound memory access when calling smb3_notify() at mount point (Paulo Alcantara) [RHEL-34672] - cifs: allocate buffer in the caller of build_path_from_dentry() (Paulo Alcantara) [RHEL-34672] - cifs: make build_path_from_dentry() return const char * (Paulo Alcantara) [RHEL-34672] - cifs: remove old dead code (Paulo Alcantara) [RHEL-34672] - fs: cifs: Remove repeated struct declaration (Paulo Alcantara) [RHEL-34672] - cifs: have cifs_fattr_to_inode() refuse to change type on live inode (Paulo Alcantara) [RHEL-34672] - cifs: have ->mkdir() handle race with another client sanely (Paulo Alcantara) [RHEL-34672] - do_cifs_create(): don't set ->i_mode of something we had not created (Paulo Alcantara) [RHEL-34672] - cifs: Silently ignore unknown oplock break handle (Paulo Alcantara) [RHEL-34672] - cifs: change noisy error message to FYI (Paulo Alcantara) [RHEL-34672] - cifs: print MIDs in decimal notation (Paulo Alcantara) [RHEL-34672] - cifs: minor simplification to smb2_is_network_name_deleted (Paulo Alcantara) [RHEL-34672] - TCON Reconnect during STATUS_NETWORK_NAME_DELETED (Paulo Alcantara) [RHEL-34672] - cifs: clarify hostname vs ip address in /proc/fs/cifs/DebugData (Paulo Alcantara) [RHEL-34672] - cifs: change confusing field serverName (to ip_addr) (Paulo Alcantara) [RHEL-34672] - cifs: Reformat DebugData and index connections by conn_id. (Paulo Alcantara) [RHEL-34672] - cifs: Identify a connection by a conn_id. (Paulo Alcantara) [RHEL-34672] - smb3: negotiate current dialect (SMB3.1.1) when version 3 or greater requested (Paulo Alcantara) [RHEL-34672] - smb3: Fix out-of-bounds bug in SMB2_negotiate() (Paulo Alcantara) [RHEL-34672] - fs/cifs: Simplify bool comparison. (Paulo Alcantara) [RHEL-34672] - fs/cifs: Assign boolean values to a bool variable (Paulo Alcantara) [RHEL-34672] - cifs: Avoid error pointer dereference (Paulo Alcantara) [RHEL-34672] - cifs: Re-indent cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Unlock on errors in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Delete a stray unlock in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Tracepoints and logs for tracing credit changes. (Paulo Alcantara) [RHEL-34672] - cifs: Fix some error pointers handling detected by static checker (Paulo Alcantara) [RHEL-34672] - smb3: remind users that witness protocol is experimental (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: do not log warning message if server doesn't populate salt (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: update comments clarifying SPNEGO info in negprot response (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot rsp (Paulo Alcantara) [RHEL-34672] - SMB3: avoid confusing warning message on mount to Azure (Paulo Alcantara) [RHEL-34672] - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (Nigel Croxon) [RHEL-46662] {CVE-2024-39476} - net: fix information leakage in /proc/net/ptype (Hangbin Liu) [RHEL-44000] {CVE-2022-48757} - usb: typec: ucsi: Limit read size on v1.2 (Desnes Nunes) [RHEL-37286] {CVE-2024-35924} - minmax: relax check to allow comparison between unsigned arguments and signed constants (Desnes Nunes) [RHEL-37286] - minmax: allow comparisons of 'int' against 'unsigned char/short' (Desnes Nunes) [RHEL-37286] - minmax: allow min()/max()/clamp() if the arguments have the same signedness. (Desnes Nunes) [RHEL-37286] - minmax: add umin(a, b) and umax(a, b) (Desnes Nunes) [RHEL-37286] - minmax: fix header inclusions (Desnes Nunes) [RHEL-37286] - minmax: clamp more efficiently by avoiding extra comparison (Desnes Nunes) [RHEL-37286] - minmax: sanity check constant bounds when clamping (Desnes Nunes) [RHEL-37286] - tracing: Define the is_signed_type() macro once (Desnes Nunes) [RHEL-37286] - linux/bits.h: fix compilation error with GENMASK (Desnes Nunes) [RHEL-37286] - x86/apic: Mask IOAPIC entries when disabling the local APIC (Lenny Szubowicz) [RHEL-18077] - userfaultfd: fix a race between writeprotect and exit_mmap() (Rafael Aquini) [RHEL-38410] {CVE-2021-47461} - mm: khugepaged: skip huge page collapse for special files (Waiman Long) [RHEL-38446] {CVE-2021-47491} - cachefiles: fix memory leak in cachefiles_add_cache() (Andrey Albershteyn) [RHEL-33109] {CVE-2024-26840} - drm/amd/display: Implement bounds check for stream encoder creation in DCN301 (Michel Dänzer) [RHEL-31429] {CVE-2024-26660} - net/mlx5: Discard command completions in internal error (Kamal Heib) [RHEL-44231] {CVE-2024-38555} - drm: Don't unref the same fb many times by mistake due to deadlock handling (CKI Backport Bot) [RHEL-29011] {CVE-2023-52486} - md: fix resync softlockup when bitmap size is less than array size (Nigel Croxon) [RHEL-43942] {CVE-2024-38598} - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation (Davide Caratti) [RHEL-39712] {CVE-2024-36017} - netfilter: nf_tables: discard table flag update with pending basechain deletion (Phil Sutter) [RHEL-37205] {CVE-2024-35897} - netfilter: nf_tables: reject table flag and netdev basechain updates (Phil Sutter) [RHEL-37205] - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (Ewan D. Milne) [RHEL-40172] {CVE-2024-36924} - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (Ewan D. Milne) [RHEL-40172] {CVE-2024-36952} - netfilter: nf_tables: fix memleak in map from abort path (Phil Sutter) [RHEL-35052] {CVE-2024-27011} - netfilter: nf_tables: reject new basechain after table flag update (Phil Sutter) [RHEL-37193] {CVE-2024-35900} - netfilter: nf_tables: flush pending destroy work before exit_net release (Phil Sutter) [RHEL-37197] {CVE-2024-35899} - netfilter: complete validation of user input (Phil Sutter) [RHEL-37210] - netfilter: validate user input for expected length (Phil Sutter) [RHEL-37210] {CVE-2024-35896} - netfilter: tproxy: bail out if IP has been disabled on the device (Phil Sutter) [RHEL-44363] {CVE-2024-36270} - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (Phil Sutter) [RHEL-44532] {CVE-2024-36286} - netfilter: nf_tables: do not compare internal table flags on updates (Phil Sutter) [RHEL-35114] {CVE-2024-27065} - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (Phil Sutter) [RHEL-35028] {CVE-2024-27019} - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (Phil Sutter) [RHEL-35024] {CVE-2024-27020} - netfilter: nf_tables: __nft_expr_type_get() selects specific family type (Phil Sutter) [RHEL-35024] - netfilter: conntrack: serialize hash resizes and cleanups (Phil Sutter) [RHEL-37703] {CVE-2021-47408} - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (Phil Sutter) [RHEL-34217] {CVE-2024-26925} - netfilter: nf_tables: release batch on table validation from abort path (Phil Sutter) [RHEL-34217] - ipvlan: add ipvlan_route_v6_outbound() helper (Davide Caratti) [RHEL-38319] {CVE-2023-52796} - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.23.1.rt7.364.el8_10 [RHEL-59541] - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002] - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924} - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042} - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070} - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898} - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301} - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976} - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540} - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284} - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857} - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924} - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983} - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854} - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936} - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093} - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961} - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880} - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244} - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984} - [rt] build kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 [RHEL-53529] - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071} - [rt] build kernel-rt-4.18.0-553.21.1.rt7.362.el8_10 [RHEL-53529] - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874] - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558} - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441} - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904} - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322} - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246} - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008} - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228} - [rt] build kernel-rt-4.18.0-553.20.1.rt7.361.el8_10 [RHEL-53529] - KVM: arm64: Disassociate vcpus from redistributor region on teardown (Shaoqin Huang) [RHEL-48417] {CVE-2024-40989} - devres: Fix memory leakage caused by driver API devm_free_percpu() (CKI Backport Bot) [RHEL-55597] {CVE-2024-43871} - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (Izabela Bakollari) [RHEL-26680] {CVE-2024-26600} - nvmet-fc: avoid deadlock on delete association path (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - nvmet-fc: release reference on target port (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - ACPI: LPIT: Avoid u32 multiplication overflow (Mark Langsdorf) [RHEL-37062] {CVE-2023-52683} - sched/deadline: Fix task_struct reference leak (Phil Auld) [RHEL-50904] {CVE-2024-41023} - nfsd: fix crash on LOCKT on reexported NFSv3 (Benjamin Coddington) [RHEL-31515] - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path (CKI Backport Bot) [RHEL-26570] {CVE-2024-26595} - mlxsw: spectrum_acl_tcam: Move devlink param to TCAM code (Ivan Vecera) [RHEL-26570] {CVE-2024-26595} - ACPI: extlog: fix NULL pointer dereference check (Mark Langsdorf) [RHEL-29110] {CVE-2023-52605} - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() (Mark Langsdorf) [RHEL-33198] {CVE-2024-26894} - mm: prevent derefencing NULL ptr in pfn_section_valid() (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - mm, kmsan: fix infinite recursion due to RCU critical section (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - cipso: make cipso_v4_skbuff_delattr() fully remove the CIPSO options (Ondrej Mosnacek) [RHEL-30904] - cipso: fix total option length computation (Ondrej Mosnacek) [RHEL-30904] - ext4: do not create EA inode under buffer lock (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: check the return value of ext4_xattr_inode_dec_ref() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (Carlos Maiolino) [RHEL-48507] {CVE-2024-40998} - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - [rt] build kernel-rt-4.18.0-553.19.1.rt7.360.el8_10 [RHEL-53529] - drm/i915/vma: Fix UAF on destroy against retire race (Mika Penttilä) [RHEL-35222] {CVE-2024-26939} - RHEL-48620 (Kenneth Yin) [RHEL-48620] - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (CKI Backport Bot) [RHEL-42721] {CVE-2024-26855} - net: usb: asix: do not force pause frames support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix "can't send until first packet is send" issue (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix modprobe "sysfs: cannot create duplicate filename" (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: add proper error handling of usb read errors (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix wrong return value in asix_check_host_enable() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix uninit-value in asix_mdio_read() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: fix boolconv.cocci warnings (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: do not call phy_disconnect() for ax88178 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: move embedded PHY detection as early as possible (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix uninit value bugs (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add missing stop (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: suspend PHY on driver probe (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: manage PHY PM from MAC (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: add error handling for asix_mdio_* functions (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add phylib support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: refactor asix_read_phy_addr() and handle errors on return (Ken Cox) [RHEL-28108] {CVE-2021-47101} - SUNRPC: always free ctxt when freeing deferred request (Jay Shin) [RHEL-40936] - SUNRPC: double free xprt_ctxt while still in use (Jay Shin) [RHEL-40936] - SUNRPC: Remove svc_rqst::rq_xprt_hlen (Jay Shin) [RHEL-40936] - SUNRPC: Remove dead code in svc_tcp_release_rqst() (Jay Shin) [RHEL-40936] - x86/bugs: Extend VMware Retbleed workaround to Nehalem & earlier CPUs (Waiman Long) [RHEL-48646] - wifi: iwlwifi: read txq->read_ptr under lock (Jose Ignacio Tornos Martinez) [RHEL-39797] {CVE-2024-36922} - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (John Meneghini) [RHEL-39908] {CVE-2024-36919} - nbd: always initialize struct msghdr completely (Ming Lei) [RHEL-29498] {CVE-2024-26638} - block: don't call rq_qos_ops->done_bio if the bio isn't tracked (Ming Lei) [RHEL-42151] {CVE-2021-47412} - nvmet: fix a possible leak when destroy a ctrl during qp establishment (Maurizio Lombardi) [RHEL-52013] {CVE-2024-42152} - ipv6: prevent NULL dereference in ip6_output() (Sabrina Dubroca) [RHEL-39912] {CVE-2024-36901} - ppp: reject claimed-as-LCP but actually malformed packets (Guillaume Nault) [RHEL-51052] {CVE-2024-41044} - leds: trigger: Unregister sysfs attributes before calling deactivate() (CKI Backport Bot) [RHEL-54834] {CVE-2024-43830} - crypto: bcm - Fix pointer arithmetic (cki-backport-bot) [RHEL-44108] {CVE-2024-38579} - scsi: qedf: Ensure the copied buf is NUL terminated (John Meneghini) [RHEL-44195] {CVE-2024-38559} - x86/bhi: Avoid warning in #DB handler due to BHI mitigation (Waiman Long) [RHEL-53657] {CVE-2024-42240} - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (CKI Backport Bot) [RHEL-47529] {CVE-2024-40901} - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (CKI Backport Bot) [RHEL-39843] {CVE-2024-36902} - net: usb: ax88179_178a: improve link status logs (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: improve reset check (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: fix link status when link is set to down/up (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: avoid writing the mac address before first reading (Jose Ignacio Tornos Martinez) [RHEL-45167] - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - media: cec: cec-api: add locking in cec_release() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid confusing "transmit timed out" message (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid recursive cec_claim_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: remove length check of Timer Status (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: count low-drive, error and arb-lost conditions (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add note about *_from_edid() function usage in drm (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_unconfigured() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_nb_transmit_canceled() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: don't set last_initiator if tx in progress (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: disable adapter in cec_devnode_unregister (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: not all messages were passed on when monitoring (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add support for Absolute Volume Control (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: log when claiming LA fails unexpectedly (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: drop activate_cnt, use state info instead (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: reconfigure if the PA changes during configuration (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: fix is_configuring state (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: stop trying LAs on CEC_TX_STATUS_TIMEOUT (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't unconfigure if already unconfigured (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add optional adap_configured callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add xfer_timeout_ms field (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: use call_op and check for !unregistered (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix interrupt en/disable handling (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: drop unused 'enabled' field from struct cec_pin (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix off-by-one SFT check (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: rename timer overrun variables (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: correctly pass on reply results (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: abort if the current transmit was canceled (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: call enable_adap on s_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: media/cec.h: document cec_adapter fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix a deadlock situation (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: safely unhook lists in cec_data (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: copy sequence field for the reply (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix trivial style warnings (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: add 'unregistered' checks (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't use flush_scheduled_work() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: Use fallthrough pseudo-keyword (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: remove unused waitq and phys_addrs fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: silence shift wrapping warning in __cec_s_log_addrs() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: move the core to a separate directory (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - net/iucv: Avoid explicit cpumask var allocation on stack (CKI Backport Bot) [RHEL-51631] {CVE-2024-42094} - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (Dick Kennedy) [RHEL-40400] - KVM: selftests: Make hyperv_clock require TSC based system clocksource (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Run clocksource dependent tests with hyperv_clocksource_tsc_page too (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Use generic sys_clocksource_is_tsc() in vmx_nested_tsc_scaling_test (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Generalize check_clocksource() from kvm_clock_test (Vitaly Kuznetsov) [RHEL-19027] - firmware: cs_dsp: Return error if block header overflows file (CKI Backport Bot) [RHEL-53646] {CVE-2024-42238} - firmware: cs_dsp: Validate payload length before processing block (CKI Backport Bot) [RHEL-53638] {CVE-2024-42237} - mm, slub: fix potential memoryleak in kmem_cache_open() (Waiman Long) [RHEL-38404] {CVE-2021-47466} - slub: don't panic for memcg kmem cache creation failure (Waiman Long) [RHEL-38404] {CVE-2021-47466} - wifi: ath11k: fix htt pktlog locking (Jose Ignacio Tornos Martinez) [RHEL-38317] {CVE-2023-52800} - wifi: ath11k: fix dfs radar event locking (Jose Ignacio Tornos Martinez) [RHEL-38165] {CVE-2023-52798} - lib/generic-radix-tree.c: Don't overflow in peek() (Waiman Long) [RHEL-37737] {CVE-2021-47432} - include/linux/generic-radix-tree.h: replace kernel.h with the necessary inclusions (Waiman Long) [RHEL-37737] {CVE-2021-47432} - EDAC/i10nm: Skip the absent memory controllers (Aristeu Rozanski) [RHEL-43236] - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (John Meneghini) [RHEL-38197] {CVE-2023-52809} - gfs2: Fix potential glock use-after-free on unmount (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: simplify gdlm_put_lock with out_free label (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: Remove ill-placed consistency check (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - nvme-fc: do not wait in vain when unloading module (Ewan D. Milne) [RHEL-33083] {CVE-2024-26846} - HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts (CKI Backport Bot) [RHEL-49698] {CVE-2022-48866} - scsi: qedf: Set qed_slowpath_params to zero before use (John Meneghini) [RHEL-9797] - scsi: qedf: Wait for stag work during unload (John Meneghini) [RHEL-9797] - scsi: qedf: Don't process stag work during unload and recovery (John Meneghini) [RHEL-9797] - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - mm: avoid overflows in dirty throttling logic (Audra Mitchell) [RHEL-51840] {CVE-2024-42131} - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - ACPI: fix NULL pointer dereference (Mark Langsdorf) [RHEL-37897] {CVE-2021-47289} - [rt] build kernel-rt-4.18.0-553.18.1.rt7.359.el8_10 [RHEL-53529] - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING (Ewan D. Milne) [RHEL-39805] {CVE-2024-36920} - tun: limit printing rate when illegal packet received by tun dev (Jon Maloy) [RHEL-35046] {CVE-2024-27013} - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu/mes: fix use-after-free issue (Michel Dänzer) [RHEL-44043] {CVE-2024-38581} - drm/amdgpu: Fix the null pointer when load rlc firmware (Michel Dänzer) [RHEL-30603] {CVE-2024-26649} - drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (Michel Dänzer) [RHEL-35160] {CVE-2024-27042} - net/sched: Fix UAF when resolving a clash (Xin Long) [RHEL-51014] {CVE-2024-41040} - tcp_metrics: validate source addr length (Guillaume Nault) [RHEL-52025] {CVE-2024-42154} - NFSv4/pnfs: Fix a use-after-free bug in open (Benjamin Coddington) [RHEL-35508] - NFSv4: Don't hold the layoutget locks across multiple RPC calls (Benjamin Coddington) [RHEL-35508] - scsi: qedf: Make qedf_execute_tmf() non-preemptible (John Meneghini) [RHEL-51799] {CVE-2024-42124} - Input: elantech - fix stack out of bound access in elantech_change_report_id() (CKI Backport Bot) [RHEL-41938] {CVE-2021-47097} - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (CKI Backport Bot) [RHEL-28982] {CVE-2023-52478} - drm/radeon: fix UBSAN warning in kv_dpm.c (CKI Backport Bot) [RHEL-48399] {CVE-2024-40988} - usb: core: Don't hold the device lock while sleeping in do_proc_control() (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - USB: core: Make do_proc_control() and do_proc_bulk() killable (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - scsi: qedi: Fix crash while reading debugfs attribute (CKI Backport Bot) [RHEL-48327] {CVE-2024-40978} - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CKI Backport Bot) [RHEL-48309] {CVE-2024-40977} - net: tcp: accept old ack during closing (Jamie Bainbridge) [RHEL-52433] - wifi: iwlwifi: mvm: don't read past the mfuart notifcation (CKI Backport Bot) [RHEL-48016] {CVE-2024-40941} - net/iucv: fix use after free in iucv_sock_close() (Mete Durlu) [RHEL-53988] - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (CKI Backport Bot) [RHEL-47908] {CVE-2024-40929} - Input: aiptek - properly check endpoint type (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - use descriptors of current altsetting (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - fix endpoint sanity check (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB (CKI Backport Bot) [RHEL-52373] {CVE-2024-42226} - wifi: mt76: replace skb_put with skb_put_zero (CKI Backport Bot) [RHEL-52366] {CVE-2024-42225} - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (CKI Backport Bot) [RHEL-47776] {CVE-2024-40912} - wifi: cfg80211: Lock wiphy in cfg80211_get_station (CKI Backport Bot) [RHEL-47758] {CVE-2024-40911} - VMCI: Use struct_size() in kmalloc() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() (Steve Best) [RHEL-37325] {CVE-2024-35944} - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values (Jose Ignacio Tornos Martinez) [RHEL-51761] {CVE-2024-42114} - usb: atm: cxacru: fix endpoint checking in cxacru_bind() (CKI Backport Bot) [RHEL-51442] {CVE-2024-41097} - nfs: handle error of rpc_proc_register() in init_nfs_fs() (Scott Mayhew) [RHEL-39904] {CVE-2024-36939} - drm/radeon: check bo_va->bo is non-NULL before using it (CKI Backport Bot) [RHEL-51184] {CVE-2024-41060} - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). (CKI Backport Bot) [RHEL-51027] {CVE-2024-41041} - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (CKI Backport Bot) [RHEL-50961] {CVE-2024-41035} - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). (CKI Backport Bot) [RHEL-44408] {CVE-2024-37356} - tcp: avoid too many retransmit packets (Florian Westphal) [RHEL-48627] {CVE-2024-41007} - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() (Florian Westphal) [RHEL-48627] - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Florian Westphal) [RHEL-48627] - tcp: refactor tcp_retransmit_timer() (Florian Westphal) [RHEL-48627] - tcp: exit if nothing to retransmit on RTO timeout (Florian Westphal) [RHEL-48627] - netfilter: nf_tables: Reject tables of unsupported family (Florian Westphal) [RHEL-21418] {CVE-2023-6040} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.23.1.rt7.364.el8_10 [RHEL-59541] - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002] - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924} - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042} - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070} - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898} - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301} - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976} - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540} - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284} - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857} - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924} - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983} - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854} - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936} - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093} - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961} - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880} - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244} - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984} - [rt] build kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 [RHEL-53529] - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071} - [rt] build kernel-rt-4.18.0-553.21.1.rt7.362.el8_10 [RHEL-53529] - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874] - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558} - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441} - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904} - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322} - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246} - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008} - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228} - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.23.1.rt7.364.el8_10 [RHEL-59541] - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002] - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924} - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042} - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070} - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898} - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301} - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976} - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540} - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284} - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857} - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924} - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983} - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854} - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936} - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093} - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961} - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880} - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244} - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - [rt] build kernel-rt-4.18.0-553.35.1.rt7.376.el8_10 [RHEL-72569] - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480] - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480] - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396] - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - [rt] build kernel-rt-4.18.0-553.35.1.rt7.376.el8_10 [RHEL-72569] - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480] - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480] - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396] - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - [rt] build kernel-rt-4.18.0-553.35.1.rt7.376.el8_10 [RHEL-72569] - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480] - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480] - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396] - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.5.1.rt7.346.el8_10 [RHEL-34640] - tools/power/turbostat: Fix uncore frequency file string (David Arcari) [RHEL-29238] - tools/power turbostat: Expand probe_intel_uncore_frequency() (David Arcari) [RHEL-29238] - uio: Fix use-after-free in uio_open (Ricardo Robaina) [RHEL-26232] {CVE-2023-52439} - net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (Ken Cox) [RHEL-27316] {CVE-2021-47013} - keys: Fix linking a duplicate key to a keyring's assoc_array (David Howells) [RHEL-30772] - keys: Hoist locking out of __key_link_begin() (David Howells) [RHEL-30772] - keys: Break bits out of key_unlink() (David Howells) [RHEL-30772] - keys: Change keyring_serialise_link_sem to a mutex (David Howells) [RHEL-30772] - wifi: brcm80211: handle pmk_op allocation failure (Jose Ignacio Tornos Martinez) [RHEL-35150] {CVE-2024-27048} - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work (Jose Ignacio Tornos Martinez) [RHEL-35140] {CVE-2024-27052} - wifi: iwlwifi: mvm: ensure offloading TID queue exists (Jose Ignacio Tornos Martinez) [RHEL-35130] {CVE-2024-27056} - wifi: mt76: mt7921e: fix use-after-free in free_irq() (Jose Ignacio Tornos Martinez) [RHEL-34866] {CVE-2024-26892} - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete (Jose Ignacio Tornos Martinez) [RHEL-34189] {CVE-2024-26897} - wifi: iwlwifi: mvm: fix a crash when we run out of stations (Jose Ignacio Tornos Martinez) [RHEL-31547] {CVE-2024-26693} - wifi: iwlwifi: fix double-free bug (Jose Ignacio Tornos Martinez) [RHEL-31543] {CVE-2024-26694} - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (Jose Ignacio Tornos Martinez) [RHEL-29089] {CVE-2023-52594} - wifi: rt2x00: restart beacon queue when hardware reset (Jose Ignacio Tornos Martinez) [RHEL-29093] {CVE-2023-52595} - wifi: iwlwifi: fix a memory corruption (Jose Ignacio Tornos Martinez) [RHEL-28903] {CVE-2024-26610} - [rt] build kernel-rt-4.18.0-553.4.1.rt7.345.el8_10 [RHEL-34640] - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117] - net/mlx5e: Prevent deadlock while disabling aRFS (Kamal Heib) [RHEL-35041] {CVE-2024-27014} - x86/tsc: Defer marking TSC unstable to a worker (Wander Lairson Costa) [RHEL-32676] - x86/smpboot: Make TSC synchronization function call based (Wander Lairson Costa) [RHEL-32676] - net: usb: fix possible use-after-free in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - net: usb: fix memory leak in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - [rt] build kernel-rt-4.18.0-552.3.1.rt7.344.el8_10 [RHEL-34640] - netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (Phil Sutter) [RHEL-30076] {CVE-2024-26643} - netfilter: nf_tables: disallow anonymous set with timeout flag (Phil Sutter) [RHEL-30080] {CVE-2024-26642} - selftests/bpf: Fix pyperf180 compilation failure with clang18 (Artem Savkov) [RHEL-35576] - md/raid5: fix atomicity violation in raid5_cache_count (Nigel Croxon) [RHEL-27930] {CVE-2024-23307} - usb: ulpi: Fix debugfs directory leak (Desnes Nunes) [RHEL-33287] {CVE-2024-26919} - powerpc/pseries: Fix potential memleak in papr_get_attr() (Mamatha Inamdar) [RHEL-35213] {CVE-2022-48669} - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (Desnes Nunes) [RHEL-35122] {CVE-2024-27059} - NFSv4: fairly test all delegations on a SEQ4_ revocation (Benjamin Coddington) [RHEL-34912] - USB: core: Fix deadlock in usb_deauthorize_interface() (Desnes Nunes) [RHEL-35002] {CVE-2024-26934} - usb: xhci: Add error handling in xhci_map_urb_for_dma (Desnes Nunes) [RHEL-34958] {CVE-2024-26964} - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (Ewan D. Milne) [RHEL-35076] {CVE-2024-26993} - xhci: handle isoc Babble and Buffer Overrun events properly (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - xhci: process isoc TD properly when there was a transaction error mid TD. (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - USB: core: Fix deadlock in port "disable" sysfs attribute (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - USB: core: Add hub_get() and hub_put() routines (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - netfilter: ipset: Missing gc cancellations fixed (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix performance regression in swap operation (Phil Sutter) [RHEL-30521] - netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test (Phil Sutter) [RHEL-30521] - x86/apic/x2apic: Fix a NULL pointer deref when handling a dying cpu (David Arcari) [RHEL-32516] - x86/coco: Disable 32-bit emulation by default on TDX and SEV (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Make IA32_EMULATION boot time configurable (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/elf: Make loading of 32bit processes depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Rename ignore_sysret() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/cpu: Don't write CSTAR MSR on Intel CPUs (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Introduce ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - [rt] build kernel-rt-4.18.0-552.2.1.rt7.343.el8_10 [RHEL-34640] - s390/ptrace: handle setting of fpc register correctly (Tobias Huschle) [RHEL-29106] {CVE-2023-52598} - net/smc: fix illegal rmb_desc access in SMC-D connection dump (Tobias Huschle) [RHEL-27746] {CVE-2024-26615} - wifi: mac80211: fix race condition on enabling fast-xmit (Jose Ignacio Tornos Martinez) [RHEL-31664] {CVE-2024-26779} - powerpc/fadump: make is_kdump_kernel() return false when fadump is active (Mamatha Inamdar) [RHEL-24401] - vmcore: remove dependency with is_kdump_kernel() for exporting vmcore (Mamatha Inamdar) [RHEL-24401] - mtd: require write permissions for locking and badblock ioctls (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - mtd: properly check all write ioctls for permissions (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - pid: take a reference when initializing `cad_pid` (Waiman Long) [RHEL-29420] {CVE-2021-47118} - i2c: i801: Don't generate an interrupt on bus reset (Prarit Bhargava) [RHEL-30325] {CVE-2021-47153} - RDMA/srpt: Do not register event handler until srpt device is fully setup (Kamal Heib) [RHEL-33224] {CVE-2024-26872} - ceph: switch to corrected encoding of max_xattr_size in mdsmap (Xiubo Li) [RHEL-26723] - ceph: switch to use cap_delay_lock for the unlink delay list (Xiubo Li) [RHEL-32870] - ceph: pass ino# instead of old_dentry if it's disconnected (Xiubo Li) [RHEL-32870] - fat: fix uninitialized field in nostale filehandles (Andrey Albershteyn) [RHEL-33186 RHEL-35108] {CVE-2024-26973} - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (Andrey Albershteyn) [RHEL-33186] {CVE-2024-26901} - idpf: limit the support to GCP only (Michal Schmidt) [RHEL-15652] - redhat/configs: enable CONFIG_IDPF (Michal Schmidt) [RHEL-15652] - idpf: remove the use of ETHTOOL_RING_USE_TCP_DATA_SPLIT (Michal Schmidt) [RHEL-15652] - idpf: workaround for unavailable skb page recycling (Michal Schmidt) [RHEL-15652] - idpf: always allocate a full page (Michal Schmidt) [RHEL-15652] - idpf: remove page pool stats code (Michal Schmidt) [RHEL-15652] - idpf: add minimal macros for __free(kfree) to work (Michal Schmidt) [RHEL-15652] - idpf: fixup include paths for RHEL 8 (Michal Schmidt) [RHEL-15652] - idpf: fix kernel panic on unknown packet types (Michal Schmidt) [RHEL-15652] - idpf: disable local BH when scheduling napi for marker packets (Michal Schmidt) [RHEL-15652] - idpf: remove dealloc vector msg err in idpf_intr_rel (Michal Schmidt) [RHEL-15652] - idpf: fix minor controlq issues (Michal Schmidt) [RHEL-15652] - idpf: prevent deinit uninitialized virtchnl core (Michal Schmidt) [RHEL-15652] - idpf: cleanup virtchnl cruft (Michal Schmidt) [RHEL-15652] - idpf: refactor idpf_recv_mb_msg (Michal Schmidt) [RHEL-15652] - idpf: add async_handler for MAC filter messages (Michal Schmidt) [RHEL-15652] - idpf: refactor remaining virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor queue related virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor vport virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: implement virtchnl transaction manager (Michal Schmidt) [RHEL-15652] - idpf: add idpf_virtchnl.h (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler padding in virtchnl2_ptype struct (Michal Schmidt) [RHEL-15652] - idpf: distinguish vports by the dev_port attribute (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler introduced padding in virtchnl2_rss_key struct (Michal Schmidt) [RHEL-15652] - idpf: fix corrupted frames and skb leaks in singleq mode (Michal Schmidt) [RHEL-15652] - idpf: refactor some missing field get/prep conversions (Michal Schmidt) [RHEL-15652] - idpf: add get/set for Ethtool's header split ringparam (Michal Schmidt) [RHEL-15652] - idpf: fix potential use-after-free in idpf_tso() (Michal Schmidt) [RHEL-15652] - idpf: cancel mailbox work in error path (Michal Schmidt) [RHEL-15652] - idpf: set scheduling mode for completion queue (Michal Schmidt) [RHEL-15652] - idpf: add SRIOV support and other ndo_ops (Michal Schmidt) [RHEL-15652] - idpf: add ethtool callbacks (Michal Schmidt) [RHEL-15652] - idpf: add singleq start_xmit and napi poll (Michal Schmidt) [RHEL-15652] - idpf: add RX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add TX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add splitq start_xmit (Michal Schmidt) [RHEL-15652] - idpf: initialize interrupts and enable vport (Michal Schmidt) [RHEL-15652] - idpf: configure resources for RX queues (Michal Schmidt) [RHEL-15652] - idpf: configure resources for TX queues (Michal Schmidt) [RHEL-15652] - idpf: add ptypes and MAC filter support (Michal Schmidt) [RHEL-15652] - idpf: add create vport and netdev configuration (Michal Schmidt) [RHEL-15652] - idpf: add core init and interrupt request (Michal Schmidt) [RHEL-15652] - idpf: add controlq init and reset checks (Michal Schmidt) [RHEL-15652] - idpf: add module register and probe functionality (Michal Schmidt) [RHEL-15652] - virtchnl: add virtchnl version 2 ops (Michal Schmidt) [RHEL-15652] - net: netdev_queue: netdev_txq_completed_mb(): fix wake condition (Michal Schmidt) [RHEL-15652] - net: piggy back on the memory barrier in bql when waking queues (Michal Schmidt) [RHEL-15652] - net: provide macros for commonly copied lockless queue stop/wake code (Michal Schmidt) [RHEL-15652] - [rt] build kernel-rt-4.18.0-552.1.1.rt7.342.el8_10 [RHEL-34640] - build: Update RTBZ for 8.10 z-stream builds (Denys Vlasenko) - redhat: set DIST to el8_10 and ZSTREAM to yes for 8.10 (Denys Vlasenko) - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (Prarit Bhargava) [RHEL-32590] {CVE-2021-47185} - net: mana: Fix Rx DMA datasize and skb_over_panic (Cathy Avery) [RHEL-32579] - RDMA/srpt: Support specifying the srpt_service_guid parameter (Kamal Heib) [RHEL-31710] {CVE-2024-26744} - RDMA/qedr: Fix qedr_create_user_qp error flow (Kamal Heib) [RHEL-31714] {CVE-2024-26743} - hwmon: (coretemp) Fix out-of-bounds memory access (David Arcari) [RHEL-31305] {CVE-2024-26664} - RDMA/irdma: Fix KASAN issue with tasklet (Kamal Heib) [RHEL-15776] - net: bridge: use DEV_STATS_INC() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: Fix unwanted sign extension in netdev_stats_to_stats64() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: add atomic_long_t to net_device_stats fields (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net/sched: act_ct: fix skb leak and crash on ooo frags (Xin Long) [RHEL-29467] {CVE-2023-52610} - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Jose Ignacio Tornos Martinez) [RHEL-28015] {CVE-2023-52528} - RDMA/core: Fix uninit-value access in ib_get_eth_speed() (Kamal Heib) [RHEL-30130] - RDMA/core: Get IB width and speed from netdev (Kamal Heib) [RHEL-30130] - cpufreq: intel_pstate: Add Emerald Rapids support in no-HWP mode (Prarit Bhargava) [RHEL-29444] - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add (Mamatha Inamdar) [RHEL-29118] {CVE-2023-52607} - powerpc/lib: Validate size for vector operations (Mamatha Inamdar) [RHEL-29114] {CVE-2023-52606} - usb: hub: Guard against accesses to uninitialized BOS descriptors (Desnes Nunes) [RHEL-28986] {CVE-2023-52477} - media: uvcvideo: Fix OOB read (Desnes Nunes) [RHEL-27940] {CVE-2023-52565} - media: pvrusb2: fix use after free on context disconnection (Desnes Nunes) [RHEL-26498] {CVE-2023-52445} - i2c: i801: Fix block process call transactions (Prarit Bhargava) [RHEL-26478] {CVE-2024-26593} - overlay: disable EVM (Coiby Xu) [RHEL-19863] - evm: add support to disable EVM on unsupported filesystems (Coiby Xu) [RHEL-19863] - evm: don't copy up 'security.evm' xattr (Coiby Xu) [RHEL-19863] - net: ena: Remove ena_select_queue (Kamal Heib) [RHEL-14286] - media: dvbdev: Fix memory leak in dvb_media_device_free() (Prarit Bhargava) [RHEL-27254] {CVE-2020-36777} - gfs2: Fix invalid metadata access in punch_hole (Andrew Price) [RHEL-28784] - i2c: Fix a potential use after free (Prarit Bhargava) [RHEL-26849] {CVE-2019-25162} - i2c: validate user data in compat ioctl (Prarit Bhargava) [RHEL-27022] {CVE-2021-46934} - platform/x86: think-lmi: Fix reference leak (Prarit Bhargava) [RHEL-28030] {CVE-2023-52520} - vhost: use kzalloc() instead of kmalloc() followed by memset() (Jon Maloy) [RHEL-21505] {CVE-2024-0340} - RDMA/siw: Fix connection failure handling (Kamal Heib) [RHEL-28042] {CVE-2023-52513} - vt: fix memory overlapping when deleting chars in the buffer (Waiman Long) [RHEL-27778 RHEL-27779] {CVE-2022-48627} - x86/fpu: Stop relying on userspace for info to fault in xsave buffer (Steve Best) [RHEL-26669] {CVE-2024-26603} - mptcp: fix double-free on socket dismantle (Davide Caratti) [RHEL-22773] {CVE-2024-26782} - crypto: akcipher - Disable signing and decryption (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: akcipher - default implementations for request callbacks (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: testmgr - split akcipher tests by a key type (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - workqueue: Warn when a rescuer could not be created (Waiman Long) [RHEL-22136] - RDMA/cma: Avoid GID lookups on iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/cma: Deduplicate error flow in cma_validate_port() (Benjamin Coddington) [RHEL-12456] - RDMA/core: Set gid_attr.ndev for iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/siw: Fabricate a GID on tun and loopback devices (Benjamin Coddington) [RHEL-12456] - eventpoll: fix missing wakeup for ovflist in ep_poll_callback (Luis Claudio R. Goncalves) [RHEL-23022] - [rt] build kernel-rt-4.18.0-552.rt7.341.el8 [RHEL-5332] - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248] - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248] - [rt] build kernel-rt-4.18.0-551.rt7.340.el8 [RHEL-5332] - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742} - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992] - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992] - [rt] build kernel-rt-4.18.0-550.rt7.339.el8 [RHEL-5332] - mm/sparsemem: fix race in accessing memory_section->usage (Waiman Long) [RHEL-28875 RHEL-28876] {CVE-2023-52489} - mm: use __pfn_to_section() instead of open coding it (Waiman Long) [RHEL-28875] {CVE-2023-52489} - [rt] build kernel-rt-4.18.0-549.rt7.338.el8 [RHEL-5332] - dm-integrity: align the outgoing bio in integrity_recheck (Benjamin Marzinski) [RHEL-29678] - dm-integrity: fix a memory leak when rechecking the data (Benjamin Marzinski) [RHEL-29678] - RDMA/mana_ib: Add CQ interrupt support for RAW QP (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: query device capabilities (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: register RDMA device with GDMA (Maxim Levitsky) [RHEL-23934] - net: mana: add msix index sharing between EQs (Maxim Levitsky) [RHEL-23934] - net: mana: Fix spelling mistake "enforecement" -> "enforcement" (Maxim Levitsky) [RHEL-23934] - net :mana :Add remaining GDMA stats for MANA to ethtool (Maxim Levitsky) [RHEL-23934] - net: mana: Fix oversized sge0 for GSO packets (Maxim Levitsky) [RHEL-23934] - net: mana: Fix TX CQE error handling (Maxim Levitsky) [RHEL-23934] - net: mana: Add gdma stats to ethtool output for mana (Maxim Levitsky) [RHEL-23934] - net: mana: Fix MANA VF unload when hardware is unresponsive (Maxim Levitsky) [RHEL-23934] - net: mana: Configure hwc timeout from hardware (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (Maxim Levitsky) [RHEL-23934] - [rt] build kernel-rt-4.18.0-548.rt7.337.el8 [RHEL-5332] - gitlab-ci: enable arm64/s390x/ppc64le debug builds (Michael Hofmann) - arm64: Add missing bits of AmpereOne Spectre-BHB mitigation (Mark Salter) [RHEL-29005] - [rt] enable CONFIG_DRM_MGAG200_IOBURST_WORKAROUND (Jocelyn Falempe) [RHEL-13214] - drm/mgag200: Add a workaround for low-latency (Jocelyn Falempe) [RHEL-13214] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - [rt] build kernel-rt-4.18.0-553.8.1.rt7.349.el8_10 [RHEL-40882] - udf: Fix NULL pointer dereference in udf_symlink function (Pavel Reichl) [RHEL-37769] {CVE-2021-47353} - net: ti: fix UAF in tlan_remove_one (Jose Ignacio Tornos Martinez) [RHEL-38940] {CVE-2021-47310} - ARM: footbridge: fix PCI interrupt mapping (Myron Stowe) [RHEL-26971] {CVE-2021-46909} - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (Kamal Heib) [RHEL-37454] {CVE-2024-36004} - net/mlx5e: Fix mlx5e_priv_init() cleanup flow (Kamal Heib) [RHEL-37424] {CVE-2024-35959} - net/mlx5: Properly link new fs rules into the tree (Kamal Heib) [RHEL-37420] {CVE-2024-35960} - net/mlx5e: fix a potential double-free in fs_any_create_groups (Kamal Heib) [RHEL-37091] {CVE-2023-52667} - net: ena: Fix incorrect descriptor free behavior (Kamal Heib) [RHEL-37428] {CVE-2024-35958} - mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - mISDN: fix possible use-after-free in HFC_cleanup() (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - implement dh fallback for primes > 4K (Vladis Dronov) [RHEL-35106] - crypto: qat - avoid division by zero (Vladis Dronov) [RHEL-35106] - crypto: qat - resolve race condition during AER recovery (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - use kcalloc_node() instead of kzalloc_node() (Vladis Dronov) [RHEL-35106] - [rt] Enable CONFIG_DRM_MGAG200_DISABLE_WRITECOMBINE (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Add an option to disable Write-Combine (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Fix caching setup for remapped video memory (Jocelyn Falempe) [RHEL-36172] - Revert "drm/mgag200: Add a workaround for low-latency" (Jocelyn Falempe) [RHEL-36172] - mptcp: fix data re-injection from stale subflow (Davide Caratti) [RHEL-33133] {CVE-2024-26826} - ipv6: sr: fix incorrect unregister order (Hangbin Liu) [RHEL-31730] - ipv6: sr: fix possible use-after-free and null-ptr-deref (Hangbin Liu) [RHEL-31730] {CVE-2024-26735} - net/bnx2x: Prevent access to a freed page in page_pool (Michal Schmidt) [RHEL-14195 RHEL-33243] {CVE-2024-26859} - bnx2x: new flag for track HW resource allocation (Michal Schmidt) [RHEL-14195 RHEL-33243] - bnx2x: fix page fault following EEH recovery (Michal Schmidt) [RHEL-14195 RHEL-33243] - x86: KVM: SVM: always update the x2avic msr interception (Maxim Levitsky) [RHEL-15495] {CVE-2023-5090} - EDAC/thunderx: Fix possible out-of-bounds string access (Aristeu Rozanski) [RHEL-26573] {CVE-2023-52464} - [rt] build kernel-rt-4.18.0-553.7.1.rt7.348.el8_10 [RHEL-34640] - net: qcom/emac: fix UAF in emac_remove (Ken Cox) [RHEL-37834] {CVE-2021-47311} - perf/core: Bail out early if the request AUX area is out of bound (Michael Petlan) [RHEL-38268] {CVE-2023-52835} - crypto: pcrypt - Fix hungtask for PADATA_RESET (Herbert Xu) [RHEL-38171] {CVE-2023-52813} - drm/amdgpu: fix use-after-free bug (Jocelyn Falempe) [RHEL-31240] {CVE-2024-26656} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash (Ivan Vecera) [RHEL-37008] {CVE-2024-35854} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update (Ivan Vecera) [RHEL-37004] {CVE-2024-35855} - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (Ivan Vecera) [RHEL-37012] {CVE-2024-35853} - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work (Ivan Vecera) [RHEL-37016] {CVE-2024-35852} - mlxsw: spectrum_acl_tcam: Fix warning during rehash (Ivan Vecera) [RHEL-37480] {CVE-2024-36007} - can: peak_pci: peak_pci_remove(): fix UAF (Jose Ignacio Tornos Martinez) [RHEL-38419] {CVE-2021-47456} - usbnet: fix error return code in usbnet_probe() (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - usbnet: sanity check for maxpacket (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - net/mlx5e: fix a double-free in arfs_create_groups (Kamal Heib) [RHEL-36920] {CVE-2024-35835} - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds (Jose Ignacio Tornos Martinez) [RHEL-38220] {CVE-2023-52878} - net: cdc_eem: fix tx fixup skb leak (Jose Ignacio Tornos Martinez) [RHEL-38080] {CVE-2021-47236} - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Jose Ignacio Tornos Martinez) [RHEL-38113] {CVE-2023-52703} - usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() (Desnes Nunes) [RHEL-38248] {CVE-2023-52877} - usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (Desnes Nunes) [RHEL-38240] {CVE-2023-52781} - gro: fix ownership transfer (Xin Long) [RHEL-37226] {CVE-2024-35890} - tipc: fix kernel warning when sending SYN message (Xin Long) [RHEL-38109] {CVE-2023-52700} - erspan: make sure erspan_base_hdr is present in skb->head (Xin Long) [RHEL-37230] {CVE-2024-35888} - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() (Bryan Gurney) [RHEL-17366] - scsi: mpi3mr: Sanitise num_phys (Bryan Gurney) [RHEL-17366] - netfilter: nf_tables: use timestamp to check for set element timeout (Phil Sutter) [RHEL-38023] {CVE-2024-27397} - net/ipv6: SKB symmetric hash should incorporate transport ports (Sabrina Dubroca) [RHEL-32061] - crypto: s390/aes - Fix buffer overread in CTR mode (Herbert Xu) [RHEL-37089] {CVE-2023-52669} - net: Save and restore msg_namelen in sock_sendmsg (Jamie Bainbridge) [RHEL-35893] - net: prevent address rewrite in kernel_bind() (Jamie Bainbridge) [RHEL-35893] - net: prevent rewrite of msg_name in sock_sendmsg() (Jamie Bainbridge) [RHEL-35893] - net: replace calls to sock->ops->connect() with kernel_connect() (Jamie Bainbridge) [RHEL-35893] - net: Avoid address overwrite in kernel_connect (Jamie Bainbridge) [RHEL-35893] - wifi: iwlwifi: dbg-tlv: ensure NUL termination (Jose Ignacio Tornos Martinez) [RHEL-37026] {CVE-2024-35845} - wifi: mac80211: fix potential sta-link leak (Jose Ignacio Tornos Martinez) [RHEL-36916] {CVE-2024-35838} - wifi: nl80211: reject iftype change with mesh ID change (Jose Ignacio Tornos Martinez) [RHEL-36884] {CVE-2024-27410} - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (Jose Ignacio Tornos Martinez) [RHEL-36807] {CVE-2024-35789} - Bluetooth: Avoid potential use-after-free in hci_error_reset (David Marlin) [RHEL-31826] {CVE-2024-26801} - tls: disable async encrypt/decrypt (Sabrina Dubroca) [RHEL-26362 RHEL-26409 RHEL-26420] {CVE-2024-26585 CVE-2024-26583 CVE-2024-26584} - Squashfs: check the inode number is not the invalid value of zero (Phillip Lougher) [RHEL-35096] {CVE-2024-26982} - ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/msg.c: update and document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/sem.c: document and update memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: update/document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: remove duplicated code (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (Kamal Heib) [RHEL-30582] {CVE-2023-52626} - Revert "ACPI: bus: Rework system-level device notification handling" (Prarit Bhargava) [RHEL-21486] - hwrng: core - Fix page fault dead lock on mmap-ed hwrng (Prarit Bhargava) [RHEL-29485] {CVE-2023-52615} - [rt] build kernel-rt-4.18.0-553.6.1.rt7.347.el8_10 [RHEL-34640] - cxgb4: Properly lock TX queue for the selftest. (John B. Wyatt IV) [RHEL-8779] - powerpc/powernv: Add a null pointer check in opal_event_init() (Mamatha Inamdar) [RHEL-37058] {CVE-2023-52686} - crypto: rsa - add a check for allocation failure (Vladis Dronov) [RHEL-35361] - crypto: rsa - allow only odd e and restrict value in FIPS mode (Vladis Dronov) [RHEL-35361] - KEYS: use kfree_sensitive with key (Vladis Dronov) [RHEL-35361] - lib/mpi: Extend the MPI library (only mpi_*_bit() part) (Vladis Dronov) [RHEL-35361] - net: ip_tunnel: prevent perpetual headroom growth (Felix Maurer) [RHEL-31814] {CVE-2024-26804} - s390/cpum_cf: make crypto counters upward compatible across machine types (Tobias Huschle) [RHEL-36048] - RDMA/mlx5: Fix fortify source warning while accessing Eth segment (Kamal Heib) [RHEL-33162] {CVE-2024-26907} - ovl: fix leaked dentry (Miklos Szeredi) [RHEL-27306] {CVE-2021-46972} - x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - x86/mm/vsyscall: Consider vsyscall page part of user address space (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - x86/mm: Add vsyscall address helper (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - mm/swap: fix race when skipping swapcache (Rafael Aquini) [RHEL-31644] {CVE-2024-26759} - swap: fix do_swap_page() race with swapoff (Rafael Aquini) [RHEL-31644] {CVE-2024-26759} - mm/swapfile: use percpu_ref to serialize against concurrent swapoff (Rafael Aquini) [RHEL-31644] {CVE-2024-26759} - mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions() (Rafael Aquini) [RHEL-29294] {CVE-2023-52560} - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr (Jiri Benc) [RHEL-29783] - block: null_blk: Fix handling of fake timeout request (Ming Lei) [RHEL-8130] - null_blk: fix poll request timeout handling (Ming Lei) [RHEL-8130] - block: null_blk: end timed out poll request (Ming Lei) [RHEL-8130] - block: null_blk: only set set->nr_maps as 3 if active poll_queues is > 0 (Ming Lei) [RHEL-8130] - null_blk: allow zero poll queues (Ming Lei) [RHEL-8130] - null_blk: Fix handling of submit_queues and poll_queues attributes (Ming Lei) [RHEL-8130] - null_blk: poll queue support (Ming Lei) [RHEL-8130] - null_blk: fix command timeout completion handling (Ming Lei) [RHEL-8130] - platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (Prarit Bhargava) [RHEL-27790] {CVE-2021-47073} - Bluetooth: avoid memcmp() out of bounds warning (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: hci_event: Fix coding style (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: hci_event: Fix using memcmp when comparing keys (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: Reject connection with the device which has same BD_ADDR (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: hci_event: Ignore NULL link key (David Marlin) [RHEL-3017] {CVE-2020-26555} - ppp_async: limit MRU to 64K (Guillaume Nault) [RHEL-31353] {CVE-2024-26675} - powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (Mamatha Inamdar) [RHEL-37078] {CVE-2023-52675} - tcp: do not accept ACK of bytes we never sent (Xin Long) [RHEL-21952] - [rt] build kernel-rt-4.18.0-553.5.1.rt7.346.el8_10 [RHEL-34640] - tools/power/turbostat: Fix uncore frequency file string (David Arcari) [RHEL-29238] - tools/power turbostat: Expand probe_intel_uncore_frequency() (David Arcari) [RHEL-29238] - uio: Fix use-after-free in uio_open (Ricardo Robaina) [RHEL-26232] {CVE-2023-52439} - net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (Ken Cox) [RHEL-27316] {CVE-2021-47013} - keys: Fix linking a duplicate key to a keyring's assoc_array (David Howells) [RHEL-30772] - keys: Hoist locking out of __key_link_begin() (David Howells) [RHEL-30772] - keys: Break bits out of key_unlink() (David Howells) [RHEL-30772] - keys: Change keyring_serialise_link_sem to a mutex (David Howells) [RHEL-30772] - wifi: brcm80211: handle pmk_op allocation failure (Jose Ignacio Tornos Martinez) [RHEL-35150] {CVE-2024-27048} - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work (Jose Ignacio Tornos Martinez) [RHEL-35140] {CVE-2024-27052} - wifi: iwlwifi: mvm: ensure offloading TID queue exists (Jose Ignacio Tornos Martinez) [RHEL-35130] {CVE-2024-27056} - wifi: mt76: mt7921e: fix use-after-free in free_irq() (Jose Ignacio Tornos Martinez) [RHEL-34866] {CVE-2024-26892} - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete (Jose Ignacio Tornos Martinez) [RHEL-34189] {CVE-2024-26897} - wifi: iwlwifi: mvm: fix a crash when we run out of stations (Jose Ignacio Tornos Martinez) [RHEL-31547] {CVE-2024-26693} - wifi: iwlwifi: fix double-free bug (Jose Ignacio Tornos Martinez) [RHEL-31543] {CVE-2024-26694} - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (Jose Ignacio Tornos Martinez) [RHEL-29089] {CVE-2023-52594} - wifi: rt2x00: restart beacon queue when hardware reset (Jose Ignacio Tornos Martinez) [RHEL-29093] {CVE-2023-52595} - wifi: iwlwifi: fix a memory corruption (Jose Ignacio Tornos Martinez) [RHEL-28903] {CVE-2024-26610} - [rt] build kernel-rt-4.18.0-553.4.1.rt7.345.el8_10 [RHEL-34640] - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117] - net/mlx5e: Prevent deadlock while disabling aRFS (Kamal Heib) [RHEL-35041] {CVE-2024-27014} - x86/tsc: Defer marking TSC unstable to a worker (Wander Lairson Costa) [RHEL-32676] - x86/smpboot: Make TSC synchronization function call based (Wander Lairson Costa) [RHEL-32676] - net: usb: fix possible use-after-free in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - net: usb: fix memory leak in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - [rt] build kernel-rt-4.18.0-552.3.1.rt7.344.el8_10 [RHEL-34640] - netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (Phil Sutter) [RHEL-30076] {CVE-2024-26643} - netfilter: nf_tables: disallow anonymous set with timeout flag (Phil Sutter) [RHEL-30080] {CVE-2024-26642} - selftests/bpf: Fix pyperf180 compilation failure with clang18 (Artem Savkov) [RHEL-35576] - md/raid5: fix atomicity violation in raid5_cache_count (Nigel Croxon) [RHEL-27930] {CVE-2024-23307} - usb: ulpi: Fix debugfs directory leak (Desnes Nunes) [RHEL-33287] {CVE-2024-26919} - powerpc/pseries: Fix potential memleak in papr_get_attr() (Mamatha Inamdar) [RHEL-35213] {CVE-2022-48669} - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (Desnes Nunes) [RHEL-35122] {CVE-2024-27059} - NFSv4: fairly test all delegations on a SEQ4_ revocation (Benjamin Coddington) [RHEL-34912] - USB: core: Fix deadlock in usb_deauthorize_interface() (Desnes Nunes) [RHEL-35002] {CVE-2024-26934} - usb: xhci: Add error handling in xhci_map_urb_for_dma (Desnes Nunes) [RHEL-34958] {CVE-2024-26964} - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (Ewan D. Milne) [RHEL-35076] {CVE-2024-26993} - xhci: handle isoc Babble and Buffer Overrun events properly (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - xhci: process isoc TD properly when there was a transaction error mid TD. (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - USB: core: Fix deadlock in port "disable" sysfs attribute (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - USB: core: Add hub_get() and hub_put() routines (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - netfilter: ipset: Missing gc cancellations fixed (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix performance regression in swap operation (Phil Sutter) [RHEL-30521] - netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test (Phil Sutter) [RHEL-30521] - x86/apic/x2apic: Fix a NULL pointer deref when handling a dying cpu (David Arcari) [RHEL-32516] - x86/coco: Disable 32-bit emulation by default on TDX and SEV (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Make IA32_EMULATION boot time configurable (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/elf: Make loading of 32bit processes depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Rename ignore_sysret() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/cpu: Don't write CSTAR MSR on Intel CPUs (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Introduce ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - [rt] build kernel-rt-4.18.0-552.2.1.rt7.343.el8_10 [RHEL-34640] - s390/ptrace: handle setting of fpc register correctly (Tobias Huschle) [RHEL-29106] {CVE-2023-52598} - net/smc: fix illegal rmb_desc access in SMC-D connection dump (Tobias Huschle) [RHEL-27746] {CVE-2024-26615} - wifi: mac80211: fix race condition on enabling fast-xmit (Jose Ignacio Tornos Martinez) [RHEL-31664] {CVE-2024-26779} - powerpc/fadump: make is_kdump_kernel() return false when fadump is active (Mamatha Inamdar) [RHEL-24401] - vmcore: remove dependency with is_kdump_kernel() for exporting vmcore (Mamatha Inamdar) [RHEL-24401] - mtd: require write permissions for locking and badblock ioctls (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - mtd: properly check all write ioctls for permissions (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - pid: take a reference when initializing `cad_pid` (Waiman Long) [RHEL-29420] {CVE-2021-47118} - i2c: i801: Don't generate an interrupt on bus reset (Prarit Bhargava) [RHEL-30325] {CVE-2021-47153} - RDMA/srpt: Do not register event handler until srpt device is fully setup (Kamal Heib) [RHEL-33224] {CVE-2024-26872} - ceph: switch to corrected encoding of max_xattr_size in mdsmap (Xiubo Li) [RHEL-26723] - ceph: switch to use cap_delay_lock for the unlink delay list (Xiubo Li) [RHEL-32870] - ceph: pass ino# instead of old_dentry if it's disconnected (Xiubo Li) [RHEL-32870] - fat: fix uninitialized field in nostale filehandles (Andrey Albershteyn) [RHEL-33186 RHEL-35108] {CVE-2024-26973} - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (Andrey Albershteyn) [RHEL-33186] {CVE-2024-26901} - idpf: limit the support to GCP only (Michal Schmidt) [RHEL-15652] - redhat/configs: enable CONFIG_IDPF (Michal Schmidt) [RHEL-15652] - idpf: remove the use of ETHTOOL_RING_USE_TCP_DATA_SPLIT (Michal Schmidt) [RHEL-15652] - idpf: workaround for unavailable skb page recycling (Michal Schmidt) [RHEL-15652] - idpf: always allocate a full page (Michal Schmidt) [RHEL-15652] - idpf: remove page pool stats code (Michal Schmidt) [RHEL-15652] - idpf: add minimal macros for __free(kfree) to work (Michal Schmidt) [RHEL-15652] - idpf: fixup include paths for RHEL 8 (Michal Schmidt) [RHEL-15652] - idpf: fix kernel panic on unknown packet types (Michal Schmidt) [RHEL-15652] - idpf: disable local BH when scheduling napi for marker packets (Michal Schmidt) [RHEL-15652] - idpf: remove dealloc vector msg err in idpf_intr_rel (Michal Schmidt) [RHEL-15652] - idpf: fix minor controlq issues (Michal Schmidt) [RHEL-15652] - idpf: prevent deinit uninitialized virtchnl core (Michal Schmidt) [RHEL-15652] - idpf: cleanup virtchnl cruft (Michal Schmidt) [RHEL-15652] - idpf: refactor idpf_recv_mb_msg (Michal Schmidt) [RHEL-15652] - idpf: add async_handler for MAC filter messages (Michal Schmidt) [RHEL-15652] - idpf: refactor remaining virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor queue related virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor vport virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: implement virtchnl transaction manager (Michal Schmidt) [RHEL-15652] - idpf: add idpf_virtchnl.h (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler padding in virtchnl2_ptype struct (Michal Schmidt) [RHEL-15652] - idpf: distinguish vports by the dev_port attribute (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler introduced padding in virtchnl2_rss_key struct (Michal Schmidt) [RHEL-15652] - idpf: fix corrupted frames and skb leaks in singleq mode (Michal Schmidt) [RHEL-15652] - idpf: refactor some missing field get/prep conversions (Michal Schmidt) [RHEL-15652] - idpf: add get/set for Ethtool's header split ringparam (Michal Schmidt) [RHEL-15652] - idpf: fix potential use-after-free in idpf_tso() (Michal Schmidt) [RHEL-15652] - idpf: cancel mailbox work in error path (Michal Schmidt) [RHEL-15652] - idpf: set scheduling mode for completion queue (Michal Schmidt) [RHEL-15652] - idpf: add SRIOV support and other ndo_ops (Michal Schmidt) [RHEL-15652] - idpf: add ethtool callbacks (Michal Schmidt) [RHEL-15652] - idpf: add singleq start_xmit and napi poll (Michal Schmidt) [RHEL-15652] - idpf: add RX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add TX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add splitq start_xmit (Michal Schmidt) [RHEL-15652] - idpf: initialize interrupts and enable vport (Michal Schmidt) [RHEL-15652] - idpf: configure resources for RX queues (Michal Schmidt) [RHEL-15652] - idpf: configure resources for TX queues (Michal Schmidt) [RHEL-15652] - idpf: add ptypes and MAC filter support (Michal Schmidt) [RHEL-15652] - idpf: add create vport and netdev configuration (Michal Schmidt) [RHEL-15652] - idpf: add core init and interrupt request (Michal Schmidt) [RHEL-15652] - idpf: add controlq init and reset checks (Michal Schmidt) [RHEL-15652] - idpf: add module register and probe functionality (Michal Schmidt) [RHEL-15652] - virtchnl: add virtchnl version 2 ops (Michal Schmidt) [RHEL-15652] - net: netdev_queue: netdev_txq_completed_mb(): fix wake condition (Michal Schmidt) [RHEL-15652] - net: piggy back on the memory barrier in bql when waking queues (Michal Schmidt) [RHEL-15652] - net: provide macros for commonly copied lockless queue stop/wake code (Michal Schmidt) [RHEL-15652] - [rt] build kernel-rt-4.18.0-552.1.1.rt7.342.el8_10 [RHEL-34640] - build: Update RTBZ for 8.10 z-stream builds (Denys Vlasenko) - redhat: set DIST to el8_10 and ZSTREAM to yes for 8.10 (Denys Vlasenko) - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (Prarit Bhargava) [RHEL-32590] {CVE-2021-47185} - net: mana: Fix Rx DMA datasize and skb_over_panic (Cathy Avery) [RHEL-32579] - RDMA/srpt: Support specifying the srpt_service_guid parameter (Kamal Heib) [RHEL-31710] {CVE-2024-26744} - RDMA/qedr: Fix qedr_create_user_qp error flow (Kamal Heib) [RHEL-31714] {CVE-2024-26743} - hwmon: (coretemp) Fix out-of-bounds memory access (David Arcari) [RHEL-31305] {CVE-2024-26664} - RDMA/irdma: Fix KASAN issue with tasklet (Kamal Heib) [RHEL-15776] - net: bridge: use DEV_STATS_INC() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: Fix unwanted sign extension in netdev_stats_to_stats64() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: add atomic_long_t to net_device_stats fields (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net/sched: act_ct: fix skb leak and crash on ooo frags (Xin Long) [RHEL-29467] {CVE-2023-52610} - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Jose Ignacio Tornos Martinez) [RHEL-28015] {CVE-2023-52528} - RDMA/core: Fix uninit-value access in ib_get_eth_speed() (Kamal Heib) [RHEL-30130] - RDMA/core: Get IB width and speed from netdev (Kamal Heib) [RHEL-30130] - cpufreq: intel_pstate: Add Emerald Rapids support in no-HWP mode (Prarit Bhargava) [RHEL-29444] - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add (Mamatha Inamdar) [RHEL-29118] {CVE-2023-52607} - powerpc/lib: Validate size for vector operations (Mamatha Inamdar) [RHEL-29114] {CVE-2023-52606} - usb: hub: Guard against accesses to uninitialized BOS descriptors (Desnes Nunes) [RHEL-28986] {CVE-2023-52477} - media: uvcvideo: Fix OOB read (Desnes Nunes) [RHEL-27940] {CVE-2023-52565} - media: pvrusb2: fix use after free on context disconnection (Desnes Nunes) [RHEL-26498] {CVE-2023-52445} - i2c: i801: Fix block process call transactions (Prarit Bhargava) [RHEL-26478] {CVE-2024-26593} - overlay: disable EVM (Coiby Xu) [RHEL-19863] - evm: add support to disable EVM on unsupported filesystems (Coiby Xu) [RHEL-19863] - evm: don't copy up 'security.evm' xattr (Coiby Xu) [RHEL-19863] - net: ena: Remove ena_select_queue (Kamal Heib) [RHEL-14286] - media: dvbdev: Fix memory leak in dvb_media_device_free() (Prarit Bhargava) [RHEL-27254] {CVE-2020-36777} - gfs2: Fix invalid metadata access in punch_hole (Andrew Price) [RHEL-28784] - i2c: Fix a potential use after free (Prarit Bhargava) [RHEL-26849] {CVE-2019-25162} - i2c: validate user data in compat ioctl (Prarit Bhargava) [RHEL-27022] {CVE-2021-46934} - platform/x86: think-lmi: Fix reference leak (Prarit Bhargava) [RHEL-28030] {CVE-2023-52520} - vhost: use kzalloc() instead of kmalloc() followed by memset() (Jon Maloy) [RHEL-21505] {CVE-2024-0340} - RDMA/siw: Fix connection failure handling (Kamal Heib) [RHEL-28042] {CVE-2023-52513} - vt: fix memory overlapping when deleting chars in the buffer (Waiman Long) [RHEL-27778 RHEL-27779] {CVE-2022-48627} - x86/fpu: Stop relying on userspace for info to fault in xsave buffer (Steve Best) [RHEL-26669] {CVE-2024-26603} - mptcp: fix double-free on socket dismantle (Davide Caratti) [RHEL-22773] {CVE-2024-26782} - crypto: akcipher - Disable signing and decryption (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: akcipher - default implementations for request callbacks (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: testmgr - split akcipher tests by a key type (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - workqueue: Warn when a rescuer could not be created (Waiman Long) [RHEL-22136] - RDMA/cma: Avoid GID lookups on iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/cma: Deduplicate error flow in cma_validate_port() (Benjamin Coddington) [RHEL-12456] - RDMA/core: Set gid_attr.ndev for iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/siw: Fabricate a GID on tun and loopback devices (Benjamin Coddington) [RHEL-12456] - eventpoll: fix missing wakeup for ovflist in ep_poll_callback (Luis Claudio R. Goncalves) [RHEL-23022] - [rt] build kernel-rt-4.18.0-552.rt7.341.el8 [RHEL-5332] - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248] - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248] - [rt] build kernel-rt-4.18.0-551.rt7.340.el8 [RHEL-5332] - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742} - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992] - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825} - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237] - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724} - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513} - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921] - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921] - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921] - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921] - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921] - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774] - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660] - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660] - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199] - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539} - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825} - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237] - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724} - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513} - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921] - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921] - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921] - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921] - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921] - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285} - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993} - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396] - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396] - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396] - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396] - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355] - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355] - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355] - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355] - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355] - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355] - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240} - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek) - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963] - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171] - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171] - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226] - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226] - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744] - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744] - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744] - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744] - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew) [RHEL-129945] - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774] - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660] - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660] - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199] - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539} - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825} - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237] - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724} - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513} - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921] - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921] - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921] - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921] - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921] - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301} - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933} - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051} - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449] - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096} - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285} - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993} - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396] - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396] - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396] - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396] - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355] - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355] - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355] - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355] - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355] - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355] - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240} - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek) - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963] - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171] - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171] - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226] - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226] - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744] - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744] - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744] - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744] - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew) [RHEL-129945] - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774] - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660] - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660] - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199] - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539} - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - Bluetooth: hci_event: call disconnect callback before deleting conn (CKI Backport Bot) [RHEL-137039] {CVE-2023-53673} - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CKI Backport Bot) [RHEL-134423] {CVE-2025-40277} - xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 (John J Coleman) [RHEL-111354] - xen: Fix x86 sched_clock() interface for xen (John J Coleman) [RHEL-111354] - x86/xen/time: Output xen sched_clock time from 0 (John J Coleman) [RHEL-111354] - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Olga Kornievskaia) [RHEL-132819] - vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139273] {CVE-2025-40248} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ignore ndlp rport mismatch in dev_loss_tmo callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Modify handling of ADISC based on ndlp state and RPI registration (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Delete NLP_TARGET_REMOVE flag due to obsolete usage (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo callback (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Check devloss callbk done flag for potential stale NDLP ptrs (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kref imbalance on fabric ndlps from dev_loss_tmo handler (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Update PRLO handling in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Add condition to delete ndlp object after sending BLS_RJT to an ABTS (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove NLP_RCV_PLOGI early return during RSCN processing for ndlps (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Allow lpfc_plogi_confirm_nport() logic to execute for Fabric nodes (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix list_entry null check warning in lpfc_cmpl_els_plogi() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix possible file string name overflow when updating firmware (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Validate ELS LS_ACC completion payload (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove extra ndlp kref decrement in FLOGI cmpl for loop topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Revise NPIV ELS unsol rcv cmpl logic to drop ndlp based on nlp_state (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix double free in lpfc_cmpl_els_logo_acc() caused by lpfc_nlp_not_used() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Move scsi_host_template outside dynamically allocated/freed phba (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fill in missing ndlp kref puts in error paths (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login (Ewan D. Milne) [RHEL-32324] - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301} - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933} - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051} - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449] - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096} - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285} - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993} - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396] - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396] - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396] - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396] - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355] - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355] - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355] - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355] - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355] - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355] - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240} - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek) - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963] - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171] - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171] - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226] - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226] - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744] - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744] - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744] - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744] - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew) [RHEL-129945] - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117] - [rt] build kernel-rt-4.18.0-552.rt7.341.el8 [RHEL-5332] - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248] - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248] - [rt] build kernel-rt-4.18.0-551.rt7.340.el8 [RHEL-5332] - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742} - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992] - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992] - [rt] build kernel-rt-4.18.0-550.rt7.339.el8 [RHEL-5332] - mm/sparsemem: fix race in accessing memory_section->usage (Waiman Long) [RHEL-28875 RHEL-28876] {CVE-2023-52489} - mm: use __pfn_to_section() instead of open coding it (Waiman Long) [RHEL-28875] {CVE-2023-52489} - [rt] build kernel-rt-4.18.0-549.rt7.338.el8 [RHEL-5332] - dm-integrity: align the outgoing bio in integrity_recheck (Benjamin Marzinski) [RHEL-29678] - dm-integrity: fix a memory leak when rechecking the data (Benjamin Marzinski) [RHEL-29678] - RDMA/mana_ib: Add CQ interrupt support for RAW QP (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: query device capabilities (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: register RDMA device with GDMA (Maxim Levitsky) [RHEL-23934] - net: mana: add msix index sharing between EQs (Maxim Levitsky) [RHEL-23934] - net: mana: Fix spelling mistake "enforecement" -> "enforcement" (Maxim Levitsky) [RHEL-23934] - net :mana :Add remaining GDMA stats for MANA to ethtool (Maxim Levitsky) [RHEL-23934] - net: mana: Fix oversized sge0 for GSO packets (Maxim Levitsky) [RHEL-23934] - net: mana: Fix TX CQE error handling (Maxim Levitsky) [RHEL-23934] - net: mana: Add gdma stats to ethtool output for mana (Maxim Levitsky) [RHEL-23934] - net: mana: Fix MANA VF unload when hardware is unresponsive (Maxim Levitsky) [RHEL-23934] - net: mana: Configure hwc timeout from hardware (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (Maxim Levitsky) [RHEL-23934] - [rt] build kernel-rt-4.18.0-548.rt7.337.el8 [RHEL-5332] - gitlab-ci: enable arm64/s390x/ppc64le debug builds (Michael Hofmann) - arm64: Add missing bits of AmpereOne Spectre-BHB mitigation (Mark Salter) [RHEL-29005] - [rt] enable CONFIG_DRM_MGAG200_IOBURST_WORKAROUND (Jocelyn Falempe) [RHEL-13214] - drm/mgag200: Add a workaround for low-latency (Jocelyn Falempe) [RHEL-13214] - [rt] build kernel-rt-4.18.0-547.rt7.336.el8 [RHEL-5332] - x86/efistub: Avoid placing the kernel below LOAD_PHYSICAL_ADDR (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Give up if memory attribute protocol returns an error (Lenny Szubowicz) [RHEL-2505] - x86/boot: Increase section and file alignment to 4k/512 (Lenny Szubowicz) [RHEL-2505] - x86/boot: Split off PE/COFF .data section (Lenny Szubowicz) [RHEL-2505] - x86/boot: Drop PE/COFF .reloc section (Lenny Szubowicz) [RHEL-2505] - x86/boot: Construct PE/COFF .text section from assembler (Lenny Szubowicz) [RHEL-2505] - x86/boot: Derive file size from _edata symbol (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed: Remove, discard, or assert for unwanted sections (Lenny Szubowicz) [RHEL-2505] - x86/boot: Check that there are no run-time relocations (Lenny Szubowicz) [RHEL-2505] - x86/boot: Discard .discard.unreachable for arch/x86/boot/compressed/vmlinux (Lenny Szubowicz) [RHEL-2505] - x86/boot: Define setup size in linker script (Lenny Szubowicz) [RHEL-2505] - x86/boot: Set EFI handover offset directly in header asm (Lenny Szubowicz) [RHEL-2505] - x86/boot: Drop references to startup_64 (Lenny Szubowicz) [RHEL-2505] - x86/boot: Drop redundant code setting the root device (Lenny Szubowicz) [RHEL-2505] - x86/build: Declutter the build output (Lenny Szubowicz) [RHEL-2505] - x86/boot: Omit compression buffer from PE/COFF image memory footprint (Lenny Szubowicz) [RHEL-2505] - x86/boot: Mark global variables as static (Lenny Szubowicz) [RHEL-2505] - efi/x86: Remove extra headroom for setup block (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove the 'bugger off' message (Lenny Szubowicz) [RHEL-2505] - x86/efi: Drop alignment flags from PE section headers (Lenny Szubowicz) [RHEL-2505] - efi: Put Linux specific magic number in the DOS header (Lenny Szubowicz) [RHEL-2505] - efi/x86: Fix the missing KASLR_FLAG bit in boot_params->hdr.loadflags (Lenny Szubowicz) [RHEL-2505] - efi/x86: Avoid physical KASLR on older Dell systems (Lenny Szubowicz) [RHEL-2505] - x86/boot: efistub: Assign global boot_params variable (Lenny Szubowicz) [RHEL-2505] - x86/boot: Rename conflicting 'boot_params' pointer to 'boot_params_ptr' (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Avoid legacy decompressor when doing EFI boot (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Perform SNP feature test while running in the firmware (Lenny Szubowicz) [RHEL-2505] - x86/sev: Do not try to parse for the CC blob on non-AMD hardware (Lenny Szubowicz) [RHEL-2505] - efi/libstub: Add limit argument to efi_random_alloc() (Lenny Szubowicz) [RHEL-2505] - arm64: efi: Limit allocations to 48-bit addressable physical region (Lenny Szubowicz) [RHEL-2505] - efi: libstub: use EFI_LOADER_CODE region when moving the kernel in memory (Lenny Szubowicz) [RHEL-2505] - arm64: efi: kaslr: Fix occasional random alloc (and boot) failure (Lenny Szubowicz) [RHEL-2505] - efi/libstub/random: Increase random alloc granularity (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Factor out kernel decompression and relocation (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Move global symbol references to C code (Lenny Szubowicz) [RHEL-2505] - decompress: Use 8 byte alignment (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Prefer EFI memory attributes protocol over DXE services (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Perform 4/5 level paging switch from the stub (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Merge trampoline cleanup with switching code (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Pass pgtable address to trampoline directly (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Only call the trampoline when changing paging levels (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Call trampoline directly from C code (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Avoid the need for a stack in the 32-bit trampoline (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Use standard calling convention for trampoline (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Call trampoline as a normal function (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Remove .bss/.pgtable from bzImage (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove run-time relocations from .head.text code (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Assign paging related global variables earlier (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Store boot_params pointer in callee save register (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Clear BSS in EFI handover protocol entrypoint (Lenny Szubowicz) [RHEL-2505] - x86/head_64: Store boot_params pointer in callee save register (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Don't rely on upper 32 bits of GPRs being preserved (Lenny Szubowicz) [RHEL-2505] - x86/head/64: Switch to KERNEL_CS as soon as new GDT is installed (Lenny Szubowicz) [RHEL-2505] - efi/libstub: Add memory attribute protocol definitions (Lenny Szubowicz) [RHEL-2505] - efi/x86: libstub: remove unused variable (Lenny Szubowicz) [RHEL-2505] - x86/boot: Robustify calling startup_{32,64}() from the decompressor code (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Simplify and clean up handover entry code (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Branch straight to kernel entry point from C code (Lenny Szubowicz) [RHEL-2505] - efi/x86: Avoid using code32_start (Lenny Szubowicz) [RHEL-2505] - efi/libstub/x86: Use Exit() boot service to exit the stub on errors (Lenny Szubowicz) [RHEL-2505] - efi: x86: Wipe setup_data on pure EFI boot (Lenny Szubowicz) [RHEL-2505] - efi: x86: Fix config name for setting the NX-compatibility flag in the PE header (Lenny Szubowicz) [RHEL-2505] - efi: x86: Set the NX-compatibility flag in the PE header (Lenny Szubowicz) [RHEL-2505] - efi/x86: Add kernel preferred address to PE header (Lenny Szubowicz) [RHEL-2505] - efi/x86: Use symbolic constants in PE header instead of bare numbers (Lenny Szubowicz) [RHEL-2505] - efi/x86: Drop redundant .bss section (Lenny Szubowicz) [RHEL-2505] - efi/x86: add headroom to decompressor BSS to account for setup block (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove run-time relocations from head_{32,64}.S (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed: Fix debug_puthex() parameter type (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Use 32-bit (zero-extended) MOV for z_output_len (Lenny Szubowicz) [RHEL-2505] - x86/boot: Use unsigned comparison for addresses (Lenny Szubowicz) [RHEL-2505] - x86/boot: Micro-optimize GDT loading instructions (Lenny Szubowicz) [RHEL-2505] - x86/boot: GDT limit value should be size - 1 (Lenny Szubowicz) [RHEL-2505] - efi/x86: Remove GDT setup from efi_main (Lenny Szubowicz) [RHEL-2505] - x86/boot: Clear direction and interrupt flags in startup_64 (Lenny Szubowicz) [RHEL-2505] - efi/x86: Don't depend on firmware GDT layout (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove KEEP_SEGMENTS support (Lenny Szubowicz) [RHEL-2505] - x86/boot: Handle malformed SRAT tables during early ACPI parsing (Lenny Szubowicz) [RHEL-2505] - efi/libstub/x86: Use mandatory 16-byte stack alignment in mixed mode (Lenny Szubowicz) [RHEL-2505] - efi/libstub/x86: Avoid globals to store context during mixed mode calls (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Disable paging at mixed mode entry (Lenny Szubowicz) [RHEL-2505] - x86: efi/random: Invoke EFI_RNG_PROTOCOL to seed the UEFI RNG table (Lenny Szubowicz) [RHEL-2505] - x86/asm: Make some functions local (Lenny Szubowicz) [RHEL-2505] - x86/boot: Annotate data appropriately (Lenny Szubowicz) [RHEL-2505] - x86/boot: Annotate local functions (Lenny Szubowicz) [RHEL-2505] - x86/asm: Make more symbols local (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Fix missing initialization in find_trampoline_placement() (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Fix boot on machines with broken E820 table (Lenny Szubowicz) [RHEL-2505] - x86, boot: Remove multiple copy of static function sanitize_boot_params() (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Remove unused variable (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Explain paging_prepare()'s return value (Lenny Szubowicz) [RHEL-2505] - x86/boot: Save several bytes in decompressor (Lenny Szubowicz) [RHEL-2505] - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (Audra Mitchell) [RHEL-20614] {CVE-2024-0841} - net/gve: update check for little-endianness in gve kconfig (Joshua Washington) [RHEL-29030] - [rt] build kernel-rt-4.18.0-546.rt7.335.el8 [RHEL-5332] - sched/membarrier: reduce the ability to hammer on sys_membarrier (Wander Lairson Costa) [RHEL-23430] {CVE-2024-26602} - NFS: Set the stable writes flag when initialising the super block (Benjamin Coddington) [RHEL-25266] - smb: client: fix OOB in receive_encrypted_standard() (Scott Mayhew) [RHEL-21685] {CVE-2024-0565} - scsi: core: Move scsi_host_busy() out of host lock if it is for per-command (Ming Lei) [RHEL-23942] - scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler (Ming Lei) [RHEL-23942] - gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump (Andrew Price) [RHEL-26501] {CVE-2023-52448} - smb: client: fix parsing of SMB3.1.1 POSIX create context (Paulo Alcantara) [RHEL-26241] {CVE-2023-52434} - smb: client: fix potential OOBs in smb2_parse_contexts() (Paulo Alcantara) [RHEL-26241] {CVE-2023-52434} - smb3: Replace smb2pdu 1-element arrays with flex-arrays (Jay Shin) [RHEL-22143] - cifs: Replace remaining 1-element arrays (Jay Shin) [RHEL-22143] - cifs: Convert struct fealist away from 1-element array (Jay Shin) [RHEL-22143] - cifs: remove unneeded 2bytes of padding from smb2 tree connect (Jay Shin) [RHEL-22143] - cifs: Replace zero-length arrays with flexible-array members (Jay Shin) [RHEL-22143] - cifs: Replace a couple of one-element arrays with flexible-array members (Jay Shin) [RHEL-22143] - cifs: fix FILE_BOTH_DIRECTORY_INFO definition (Jay Shin) [RHEL-22143] - nfsd: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - nfs: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - lockd: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - cifs: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - ceph: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - filelock: add a new locks_inode_context accessor function (Jeffrey Layton) [RHEL-27441] - dm-integrity, dm-verity: reduce stack usage for recheck (Benjamin Marzinski) [RHEL-27849] - dm-crypt: recheck the integrity tag after a failure (Benjamin Marzinski) [RHEL-27849] - dm-crypt: don't modify the data when using authenticated encryption (Benjamin Marzinski) [RHEL-27849] - dm-verity: recheck the hash after a failure (Benjamin Marzinski) [RHEL-27849] - dm-integrity: recheck the integrity tag after a failure (Benjamin Marzinski) [RHEL-27849] - [rt] build kernel-rt-4.18.0-545.rt7.334.el8 [RHEL-5332] - tracing/timerlat: Move hrtimer_init to timerlat_fd open() (John Kacur) [RHEL-26667] - tracing/perf: Fix double put of trace event when init fails (Michael Petlan) [RHEL-19537] - ipvlan: Add handling of NETDEV_UP events (Hangbin Liu) [RHEL-19098] - ceph: add ceph_cap_unlink_work to fire check_caps() immediately (Xiubo Li) [RHEL-21760] - ceph: always queue a writeback when revoking the Fb caps (Xiubo Li) [RHEL-21760] - ceph: always check dir caps asynchronously (Xiubo Li) [RHEL-21760] - nfs: fix redundant readdir request after get eof (Benjamin Coddington) [RHEL-7780] - NFSv4.1: fixup use EXCHGID4_FLAG_USE_PNFS_DS for DS server (Scott Mayhew) [RHEL-7994] - NFSv4.1: fix pnfs MDS=DS session trunking (Scott Mayhew) [RHEL-7994] - NFSv4.1: fix zero value filehandle in post open getattr (Scott Mayhew) [RHEL-7994] - NFSv4.1: use EXCHGID4_FLAG_USE_PNFS_DS for DS server (Scott Mayhew) [RHEL-7994] - x86/boot: Ignore NMIs during very early boot (Valentin Schneider) [RHEL-22749] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - vfs: use READ_ONCE() to access ->i_link (Jay Shin) [RHEL-141790] - fold generic_readlink() into its only caller (Jay Shin) [RHEL-141790] - fs/proc: fix uaf in proc_readdir_de() (Pavel Reichl) [RHEL-137093] {CVE-2025-40271} - Backport 'create an empty changelog file when changing its name' (Alexandra Hájková) - mptcp: fix race condition in mptcp_schedule_work() (Paolo Abeni) [RHEL-134443] {CVE-2025-40258} - mptcp: use mptcp_schedule_work instead of open-coding it (Paolo Abeni) [RHEL-134443] - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - tcp: minor optimization in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Kamal Heib) [RHEL-134347] {CVE-2025-38022} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - Bluetooth: hci_event: call disconnect callback before deleting conn (CKI Backport Bot) [RHEL-137039] {CVE-2023-53673} - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CKI Backport Bot) [RHEL-134423] {CVE-2025-40277} - xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 (John J Coleman) [RHEL-111354] - xen: Fix x86 sched_clock() interface for xen (John J Coleman) [RHEL-111354] - x86/xen/time: Output xen sched_clock time from 0 (John J Coleman) [RHEL-111354] - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Olga Kornievskaia) [RHEL-132819] - vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139273] {CVE-2025-40248} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ignore ndlp rport mismatch in dev_loss_tmo callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Modify handling of ADISC based on ndlp state and RPI registration (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Delete NLP_TARGET_REMOVE flag due to obsolete usage (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo callback (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Check devloss callbk done flag for potential stale NDLP ptrs (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kref imbalance on fabric ndlps from dev_loss_tmo handler (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Update PRLO handling in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Add condition to delete ndlp object after sending BLS_RJT to an ABTS (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove NLP_RCV_PLOGI early return during RSCN processing for ndlps (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Allow lpfc_plogi_confirm_nport() logic to execute for Fabric nodes (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix list_entry null check warning in lpfc_cmpl_els_plogi() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix possible file string name overflow when updating firmware (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Validate ELS LS_ACC completion payload (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove extra ndlp kref decrement in FLOGI cmpl for loop topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Revise NPIV ELS unsol rcv cmpl logic to drop ndlp based on nlp_state (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix double free in lpfc_cmpl_els_logo_acc() caused by lpfc_nlp_not_used() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Move scsi_host_template outside dynamically allocated/freed phba (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fill in missing ndlp kref puts in error paths (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login (Ewan D. Milne) [RHEL-32324] - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301} - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933} - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051} - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449] - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096} - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - vfs: use READ_ONCE() to access ->i_link (Jay Shin) [RHEL-141790] - fold generic_readlink() into its only caller (Jay Shin) [RHEL-141790] - fs/proc: fix uaf in proc_readdir_de() (Pavel Reichl) [RHEL-137093] {CVE-2025-40271} - Backport 'create an empty changelog file when changing its name' (Alexandra Hájková) - mptcp: fix race condition in mptcp_schedule_work() (Paolo Abeni) [RHEL-134443] {CVE-2025-40258} - mptcp: use mptcp_schedule_work instead of open-coding it (Paolo Abeni) [RHEL-134443] - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - tcp: minor optimization in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Kamal Heib) [RHEL-134347] {CVE-2025-38022} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - vfs: use READ_ONCE() to access ->i_link (Jay Shin) [RHEL-141790] - fold generic_readlink() into its only caller (Jay Shin) [RHEL-141790] - fs/proc: fix uaf in proc_readdir_de() (Pavel Reichl) [RHEL-137093] {CVE-2025-40271} - Backport 'create an empty changelog file when changing its name' (Alexandra Hájková) - mptcp: fix race condition in mptcp_schedule_work() (Paolo Abeni) [RHEL-134443] {CVE-2025-40258} - mptcp: use mptcp_schedule_work instead of open-coding it (Paolo Abeni) [RHEL-134443] - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - tcp: minor optimization in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Kamal Heib) [RHEL-134347] {CVE-2025-38022} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - autofs: use wake_up() instead of wake_up_interruptible(() (Ian Kent) [RHEL-143685] - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Ian Kent) [RHEL-143685] {CVE-2023-54134} - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141709] - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-136693] - audit: merge loops in __audit_inode_child() (Ricardo Robaina) [RHEL-140442] - bridge: mcast: Fix use-after-free during router port configuration (Mohammad Heib) [RHEL-138422] {CVE-2025-38248} - net/sched: Enforce that teql can only be used as root qdisc (CKI Backport Bot) [RHEL-146992] {CVE-2026-23074} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Marc Milgram) [RHEL-137838] {CVE-2025-38129} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143189] {CVE-2025-68800} - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126886] {CVE-2025-40064} - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147261] {CVE-2026-23097} - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-134673] - autofs: use wake_up() instead of wake_up_interruptible(() (Ian Kent) [RHEL-143685] - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Ian Kent) [RHEL-143685] {CVE-2023-54134} - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141709] - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-136693] - audit: merge loops in __audit_inode_child() (Ricardo Robaina) [RHEL-140442] - bridge: mcast: Fix use-after-free during router port configuration (Mohammad Heib) [RHEL-138422] {CVE-2025-38248} - net/sched: Enforce that teql can only be used as root qdisc (CKI Backport Bot) [RHEL-146992] {CVE-2026-23074} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Marc Milgram) [RHEL-137838] {CVE-2025-38129} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143189] {CVE-2025-68800} - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126886] {CVE-2025-40064} - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - macvlan: fix possible UAF in macvlan_forward_source() (Hangbin Liu) [RHEL-144120] {CVE-2026-23001} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-131922] - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount (Jocelyn Falempe) [RHEL-148636] - audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd references (Waiman Long) [RHEL-146026] - fs: Add a pool of extra fs->pwd references to fs_struct (Waiman Long) [RHEL-146026] - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143535] {CVE-2025-71085} - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147261] {CVE-2026-23097} - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-134673] - autofs: use wake_up() instead of wake_up_interruptible(() (Ian Kent) [RHEL-143685] - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Ian Kent) [RHEL-143685] {CVE-2023-54134} - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141709] - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-136693] - audit: merge loops in __audit_inode_child() (Ricardo Robaina) [RHEL-140442] - bridge: mcast: Fix use-after-free during router port configuration (Mohammad Heib) [RHEL-138422] {CVE-2025-38248} - net/sched: Enforce that teql can only be used as root qdisc (CKI Backport Bot) [RHEL-146992] {CVE-2026-23074} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Marc Milgram) [RHEL-137838] {CVE-2025-38129} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143189] {CVE-2025-68800} - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126886] {CVE-2025-40064} - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - x86/microcode/AMD: Revert "Backport AMD microcode commits for better microcode loading support" (Waiman Long) [RHEL-155860] - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150398] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150398] - tcp: fix forever orphan socket caused by tcp_abort (Paolo Abeni) [RHEL-146187] - xfs: fix minimum agno handling for xfs alloc modes in RHEL8 (Brian Foster) [RHEL-102464] - xfs: fix uninitialized use of flags variable in xfs_alloc_vextent() (Brian Foster) [RHEL-102464] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82523] - tcp: use this_cpu_read(*X) instead of *this_cpu_ptr(X) (Davide Caratti) [RHEL-82523] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150221] - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150221] {CVE-2026-23209} - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) [RHEL-96016] - s390/kexec: Emit an error message when cmdline is too long (Mete Durlu) [RHEL-144946] - s390/boot: Fix kernel size in bootparm area (Mete Durlu) [RHEL-144946] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-137123] - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-151614] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove useless transaction in evict_linked_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-151614] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-151614] - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146419] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146419] {CVE-2025-38323} - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136288] - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136288] - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136288] - scsi: st: Tighten the page format heuristics with MODE SELECT (John Meneghini) [RHEL-136288] - scsi: st: ERASE does not change tape location (John Meneghini) [RHEL-136288] - scsi: st: Fix array overflow in st_setup() (John Meneghini) [RHEL-136288] - scsi: st: Add sysfs file position_lost_in_reset (John Meneghini) [RHEL-136288] - scsi: st: Modify st.c to use the new scsi_error counters (John Meneghini) [RHEL-136288] - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (John Meneghini) [RHEL-136288] - scsi: st: Restore some drive settings after reset (John Meneghini) [RHEL-136288] - scsi: st: Fix input/output error on empty drive reset (John Meneghini) [RHEL-136288] - smb: client: handle lack of IPC in dfs_cache_refresh() (Paulo Alcantara) [RHEL-138235] - smb: client: allow parsing zero-length AV pairs (Paulo Alcantara) [RHEL-138235] - cifs: reduce warning log level for server not advertising interfaces (Paulo Alcantara) [RHEL-138235] - smb: client: Fix match_session bug preventing session reuse (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of kstrdup() in get_ses_refpath() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy when tree connecting to DFS interlink targets (Paulo Alcantara) [RHEL-138235] - smb: client: don't trust DFSREF_STORAGE_SERVER bit (Paulo Alcantara) [RHEL-138235] - smb: client: don't check for @leaf_fullpath in match_server() (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of TCP_Server_Info::refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: don't retry DFS targets on server shutdown (Paulo Alcantara) [RHEL-138235] - smb: client: fix return value of parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: optimize referral walk on failed link targets (Paulo Alcantara) [RHEL-138235] - smb: client: provide dns_resolve_{unc,name} helpers (Paulo Alcantara) [RHEL-138235] - smb: client: parse DNS domain name from domain= option (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS mount against old servers with NTLMSSP (Paulo Alcantara) [RHEL-138235] - smb: client: parse av pair type 4 in CHALLENGE_MESSAGE (Paulo Alcantara) [RHEL-138235] - smb: client: introduce av_for_each_entry() helper (Paulo Alcantara) [RHEL-138235] - smb: client: fix double free of TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-138235] {CVE-2025-21673} - smb: client: fix potential race in cifs_put_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy message when mounting shares (Paulo Alcantara) [RHEL-138235] - smb: client: don't try following DFS links in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow reconnect when sending ioctl (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of @nlsc param in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow more DFS referrals to be cached (Paulo Alcantara) [RHEL-138235] - smb: client: propagate error from cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS failover in multiuser mounts (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS interlink failover (Paulo Alcantara) [RHEL-138235] - smb: client: improve purging of cached referrals (Paulo Alcantara) [RHEL-138235] - smb: client: avoid unnecessary reconnects when refreshing referrals (Paulo Alcantara) [RHEL-138235] - smb: client: serialise cifs_construct_tcon() with cifs_mount_mutex (Paulo Alcantara) [RHEL-138235] - smb: client: handle DFS tcons in cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: refresh referral without acquiring refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: guarantee refcounted children from parent session (Paulo Alcantara) [RHEL-138235] {CVE-2024-35869} - smb: client: set correct id, uid and cruid for multiuser automounts (Paulo Alcantara) [RHEL-138235] {CVE-2024-26822} - cifs: change tcon status when need_reconnect is set on it (Paulo Alcantara) [RHEL-138235] - smb: client: fix potential NULL deref in parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: fix mount when dns_resolver key is not available (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs code dep in namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs naming in automount code (Paulo Alcantara) [RHEL-138235] - smb: client: rename cifs_dfs_ref.c to namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: ensure to try all targets when finding nested links (Paulo Alcantara) [RHEL-138235] - smb: client: introduce DFS_CACHE_TGT_LIST() (Paulo Alcantara) [RHEL-138235] - smb: client: fix null auth (Paulo Alcantara) [RHEL-138235] - smb: client: fix dfs link mount against w2k8 (Paulo Alcantara) [RHEL-138235] - cifs: fix charset issue in reconnection (Paulo Alcantara) [RHEL-138235] - smb: client: fix missed ses refcounting (Paulo Alcantara) [RHEL-138235] {CVE-2023-54076} - fs/nls: make load_nls() take a const parameter (Paulo Alcantara) [RHEL-138235] - smb: client: remove redundant pointer 'server' (Paulo Alcantara) [RHEL-138235] - smb: client: improve DFS mount check (Paulo Alcantara) [RHEL-138235] - smb: client: fix shared DFS root mounts with different prefixes (Paulo Alcantara) [RHEL-138235] - smb: client: fix parsing of source mount option (Paulo Alcantara) [RHEL-138235] - smb: client: fix warning in cifs_match_super() (Paulo Alcantara) [RHEL-138235] - cifs: fix max_credits implementation (Paulo Alcantara) [RHEL-138235] - cifs: fix sockaddr comparison in iface_cmp (Paulo Alcantara) [RHEL-138235] - cifs: fix status checks in cifs_tree_connect (Paulo Alcantara) [RHEL-138235] - cifs: fix smb1 mount regression (Paulo Alcantara) [RHEL-138235] - cifs: fix sharing of DFS connections (Paulo Alcantara) [RHEL-138235] - cifs: avoid potential races when handling multiple dfs tcons (Paulo Alcantara) [RHEL-138235] - cifs: protect access of TCP_Server_Info::{origin,leaf}_fullpath (Paulo Alcantara) [RHEL-138235] - cifs: avoid dup prefix path in dfs_get_automount_devname() (Paulo Alcantara) [RHEL-138235] - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL (Paulo Alcantara) [RHEL-138235] {CVE-2023-53246} - smb3: fix unusable share after force unmount failure (Paulo Alcantara) [RHEL-138235] - cifs: check only tcon status on tcon related functions (Paulo Alcantara) [RHEL-138235] - cifs: return DFS root session id in DebugData (Paulo Alcantara) [RHEL-138235] - cifs: fix use-after-free bug in refresh_cache_worker() (Paulo Alcantara) [RHEL-138235] {CVE-2023-53052} - cifs: set DFS root session in cifs_get_smb_ses() (Paulo Alcantara) [RHEL-138235] - cifs: remove unused function (Paulo Alcantara) [RHEL-138235] - cifs: remove duplicate code in __refresh_tcon() (Paulo Alcantara) [RHEL-138235] - cifs: remove redundant assignment to the variable match (Paulo Alcantara) [RHEL-138235] - cifs: use origin fullpath for automounts (Paulo Alcantara) [RHEL-138235] - cifs: fix source pathname comparison of dfs supers (Paulo Alcantara) [RHEL-138235] - cifs: fix confusing debug message (Paulo Alcantara) [RHEL-138235] - cifs: don't block in dfs_cache_noreq_update_tgthint() (Paulo Alcantara) [RHEL-138235] - cifs: refresh root referrals (Paulo Alcantara) [RHEL-138235] - cifs: fix refresh of cached referrals (Paulo Alcantara) [RHEL-138235] - cifs: share dfs connections and supers (Paulo Alcantara) [RHEL-138235] - cifs: split out ses and tcon retrieval from mount_get_conns() (Paulo Alcantara) [RHEL-138235] - cifs: set resolved ip in sockaddr (Paulo Alcantara) [RHEL-138235] - cifs: remove unused smb3_fs_context::mount_options (Paulo Alcantara) [RHEL-138235] - cifs: get rid of mount options string parsing (Paulo Alcantara) [RHEL-138235] - cifs: use fs_context for automounts (Paulo Alcantara) [RHEL-138235] - cifs: remove various function description warnings (Paulo Alcantara) [RHEL-138235] - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Select which microcode patch to load (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add more known models to entry sign checking (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Limit Entrysign signature checking to known generations (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use sha256() instead of init/update/final (Waiman Long) [RHEL-132479] - x86/microcode: Fix Entrysign revision check for Zen1/Naples (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Handle the case of no BIOS microcode (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add some forgotten models to the SHA check (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Load only SHA256-checksummed patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add get_patch_level() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Merge early_apply_microcode() into its single callsite (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Have __apply_microcode_amd() return bool (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Flush patch buffer mapping after application (Waiman Long) [RHEL-132479] - x86/mm: Carve out INVLPG inline asm for use by others (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Split load_microcode_amd() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Pay attention to the stepping dynamically (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix a -Wsometimes-uninitialized clang false positive (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use the family,model,stepping encoded in the patch ID (Waiman Long) [RHEL-132479] - x86/microcode/amd: Cache builtin microcode too (Waiman Long) [RHEL-132479] - x86/microcode/amd: Use correct per CPU ucode_cpu_info (Waiman Long) [RHEL-132479] - x86/microcode/amd: Remove X86_32 specific code in early_apply_microcode() & get_builtin_microcode() (Waiman Long) [RHEL-132479] - x86/microcode: Move core specific defines to local header (Waiman Long) [RHEL-132479] - x86/microcode/intel: Rename get_datasize() since its used externally (Waiman Long) [RHEL-132479] - x86/microcode: Make reload_early_microcode() static (Waiman Long) [RHEL-132479] - x86/microcode: Include vendor headers into microcode.h (Waiman Long) [RHEL-132479] - x86/microcode/intel: Move microcode functions out of cpu/intel.c (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Get rid of __find_equiv_id() (Waiman Long) [RHEL-132479] - x86/microcode: Add explicit CPU vendor dependency (Waiman Long) [RHEL-132479] - macvlan: fix possible UAF in macvlan_forward_source() (Hangbin Liu) [RHEL-144120] {CVE-2026-23001} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-131922] - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount (Jocelyn Falempe) [RHEL-148636] - audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd references (Waiman Long) [RHEL-146026] - fs: Add a pool of extra fs->pwd references to fs_struct (Waiman Long) [RHEL-146026] - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143535] {CVE-2025-71085} - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147261] {CVE-2026-23097} - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-134673] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930] - NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242] - pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242] - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242] - NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242] - NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242] - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242] - SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242] - NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242] - SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242] - SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242] - SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242] - SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242] - NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242] - NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419] - nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419] - pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419] - NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419] - NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419] - NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419] - NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419] - NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419] - NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419] - NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419] - NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419] - NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419] - nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419] - nfs: always check dreq->error after a commit (Mike Snitzer) [RHEL-156419] - nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419] - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231} - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942] - x86/microcode/AMD: Revert "Backport AMD microcode commits for better microcode loading support" (Waiman Long) [RHEL-155860] - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150398] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150398] - tcp: fix forever orphan socket caused by tcp_abort (Paolo Abeni) [RHEL-146187] - xfs: fix minimum agno handling for xfs alloc modes in RHEL8 (Brian Foster) [RHEL-102464] - xfs: fix uninitialized use of flags variable in xfs_alloc_vextent() (Brian Foster) [RHEL-102464] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82523] - tcp: use this_cpu_read(*X) instead of *this_cpu_ptr(X) (Davide Caratti) [RHEL-82523] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150221] - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150221] {CVE-2026-23209} - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) [RHEL-96016] - s390/kexec: Emit an error message when cmdline is too long (Mete Durlu) [RHEL-144946] - s390/boot: Fix kernel size in bootparm area (Mete Durlu) [RHEL-144946] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-137123] - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-151614] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove useless transaction in evict_linked_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-151614] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-151614] - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146419] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146419] {CVE-2025-38323} - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136288] - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136288] - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136288] - scsi: st: Tighten the page format heuristics with MODE SELECT (John Meneghini) [RHEL-136288] - scsi: st: ERASE does not change tape location (John Meneghini) [RHEL-136288] - scsi: st: Fix array overflow in st_setup() (John Meneghini) [RHEL-136288] - scsi: st: Add sysfs file position_lost_in_reset (John Meneghini) [RHEL-136288] - scsi: st: Modify st.c to use the new scsi_error counters (John Meneghini) [RHEL-136288] - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (John Meneghini) [RHEL-136288] - scsi: st: Restore some drive settings after reset (John Meneghini) [RHEL-136288] - scsi: st: Fix input/output error on empty drive reset (John Meneghini) [RHEL-136288] - smb: client: handle lack of IPC in dfs_cache_refresh() (Paulo Alcantara) [RHEL-138235] - smb: client: allow parsing zero-length AV pairs (Paulo Alcantara) [RHEL-138235] - cifs: reduce warning log level for server not advertising interfaces (Paulo Alcantara) [RHEL-138235] - smb: client: Fix match_session bug preventing session reuse (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of kstrdup() in get_ses_refpath() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy when tree connecting to DFS interlink targets (Paulo Alcantara) [RHEL-138235] - smb: client: don't trust DFSREF_STORAGE_SERVER bit (Paulo Alcantara) [RHEL-138235] - smb: client: don't check for @leaf_fullpath in match_server() (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of TCP_Server_Info::refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: don't retry DFS targets on server shutdown (Paulo Alcantara) [RHEL-138235] - smb: client: fix return value of parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: optimize referral walk on failed link targets (Paulo Alcantara) [RHEL-138235] - smb: client: provide dns_resolve_{unc,name} helpers (Paulo Alcantara) [RHEL-138235] - smb: client: parse DNS domain name from domain= option (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS mount against old servers with NTLMSSP (Paulo Alcantara) [RHEL-138235] - smb: client: parse av pair type 4 in CHALLENGE_MESSAGE (Paulo Alcantara) [RHEL-138235] - smb: client: introduce av_for_each_entry() helper (Paulo Alcantara) [RHEL-138235] - smb: client: fix double free of TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-138235] {CVE-2025-21673} - smb: client: fix potential race in cifs_put_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy message when mounting shares (Paulo Alcantara) [RHEL-138235] - smb: client: don't try following DFS links in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow reconnect when sending ioctl (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of @nlsc param in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow more DFS referrals to be cached (Paulo Alcantara) [RHEL-138235] - smb: client: propagate error from cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS failover in multiuser mounts (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS interlink failover (Paulo Alcantara) [RHEL-138235] - smb: client: improve purging of cached referrals (Paulo Alcantara) [RHEL-138235] - smb: client: avoid unnecessary reconnects when refreshing referrals (Paulo Alcantara) [RHEL-138235] - smb: client: serialise cifs_construct_tcon() with cifs_mount_mutex (Paulo Alcantara) [RHEL-138235] - smb: client: handle DFS tcons in cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: refresh referral without acquiring refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: guarantee refcounted children from parent session (Paulo Alcantara) [RHEL-138235] {CVE-2024-35869} - smb: client: set correct id, uid and cruid for multiuser automounts (Paulo Alcantara) [RHEL-138235] {CVE-2024-26822} - cifs: change tcon status when need_reconnect is set on it (Paulo Alcantara) [RHEL-138235] - smb: client: fix potential NULL deref in parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: fix mount when dns_resolver key is not available (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs code dep in namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs naming in automount code (Paulo Alcantara) [RHEL-138235] - smb: client: rename cifs_dfs_ref.c to namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: ensure to try all targets when finding nested links (Paulo Alcantara) [RHEL-138235] - smb: client: introduce DFS_CACHE_TGT_LIST() (Paulo Alcantara) [RHEL-138235] - smb: client: fix null auth (Paulo Alcantara) [RHEL-138235] - smb: client: fix dfs link mount against w2k8 (Paulo Alcantara) [RHEL-138235] - cifs: fix charset issue in reconnection (Paulo Alcantara) [RHEL-138235] - smb: client: fix missed ses refcounting (Paulo Alcantara) [RHEL-138235] {CVE-2023-54076} - fs/nls: make load_nls() take a const parameter (Paulo Alcantara) [RHEL-138235] - smb: client: remove redundant pointer 'server' (Paulo Alcantara) [RHEL-138235] - smb: client: improve DFS mount check (Paulo Alcantara) [RHEL-138235] - smb: client: fix shared DFS root mounts with different prefixes (Paulo Alcantara) [RHEL-138235] - smb: client: fix parsing of source mount option (Paulo Alcantara) [RHEL-138235] - smb: client: fix warning in cifs_match_super() (Paulo Alcantara) [RHEL-138235] - cifs: fix max_credits implementation (Paulo Alcantara) [RHEL-138235] - cifs: fix sockaddr comparison in iface_cmp (Paulo Alcantara) [RHEL-138235] - cifs: fix status checks in cifs_tree_connect (Paulo Alcantara) [RHEL-138235] - cifs: fix smb1 mount regression (Paulo Alcantara) [RHEL-138235] - cifs: fix sharing of DFS connections (Paulo Alcantara) [RHEL-138235] - cifs: avoid potential races when handling multiple dfs tcons (Paulo Alcantara) [RHEL-138235] - cifs: protect access of TCP_Server_Info::{origin,leaf}_fullpath (Paulo Alcantara) [RHEL-138235] - cifs: avoid dup prefix path in dfs_get_automount_devname() (Paulo Alcantara) [RHEL-138235] - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL (Paulo Alcantara) [RHEL-138235] {CVE-2023-53246} - smb3: fix unusable share after force unmount failure (Paulo Alcantara) [RHEL-138235] - cifs: check only tcon status on tcon related functions (Paulo Alcantara) [RHEL-138235] - cifs: return DFS root session id in DebugData (Paulo Alcantara) [RHEL-138235] - cifs: fix use-after-free bug in refresh_cache_worker() (Paulo Alcantara) [RHEL-138235] {CVE-2023-53052} - cifs: set DFS root session in cifs_get_smb_ses() (Paulo Alcantara) [RHEL-138235] - cifs: remove unused function (Paulo Alcantara) [RHEL-138235] - cifs: remove duplicate code in __refresh_tcon() (Paulo Alcantara) [RHEL-138235] - cifs: remove redundant assignment to the variable match (Paulo Alcantara) [RHEL-138235] - cifs: use origin fullpath for automounts (Paulo Alcantara) [RHEL-138235] - cifs: fix source pathname comparison of dfs supers (Paulo Alcantara) [RHEL-138235] - cifs: fix confusing debug message (Paulo Alcantara) [RHEL-138235] - cifs: don't block in dfs_cache_noreq_update_tgthint() (Paulo Alcantara) [RHEL-138235] - cifs: refresh root referrals (Paulo Alcantara) [RHEL-138235] - cifs: fix refresh of cached referrals (Paulo Alcantara) [RHEL-138235] - cifs: share dfs connections and supers (Paulo Alcantara) [RHEL-138235] - cifs: split out ses and tcon retrieval from mount_get_conns() (Paulo Alcantara) [RHEL-138235] - cifs: set resolved ip in sockaddr (Paulo Alcantara) [RHEL-138235] - cifs: remove unused smb3_fs_context::mount_options (Paulo Alcantara) [RHEL-138235] - cifs: get rid of mount options string parsing (Paulo Alcantara) [RHEL-138235] - cifs: use fs_context for automounts (Paulo Alcantara) [RHEL-138235] - cifs: remove various function description warnings (Paulo Alcantara) [RHEL-138235] - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Select which microcode patch to load (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add more known models to entry sign checking (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Limit Entrysign signature checking to known generations (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use sha256() instead of init/update/final (Waiman Long) [RHEL-132479] - x86/microcode: Fix Entrysign revision check for Zen1/Naples (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Handle the case of no BIOS microcode (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add some forgotten models to the SHA check (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Load only SHA256-checksummed patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add get_patch_level() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Merge early_apply_microcode() into its single callsite (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Have __apply_microcode_amd() return bool (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Flush patch buffer mapping after application (Waiman Long) [RHEL-132479] - x86/mm: Carve out INVLPG inline asm for use by others (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Split load_microcode_amd() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Pay attention to the stepping dynamically (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix a -Wsometimes-uninitialized clang false positive (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use the family,model,stepping encoded in the patch ID (Waiman Long) [RHEL-132479] - x86/microcode/amd: Cache builtin microcode too (Waiman Long) [RHEL-132479] - x86/microcode/amd: Use correct per CPU ucode_cpu_info (Waiman Long) [RHEL-132479] - x86/microcode/amd: Remove X86_32 specific code in early_apply_microcode() & get_builtin_microcode() (Waiman Long) [RHEL-132479] - x86/microcode: Move core specific defines to local header (Waiman Long) [RHEL-132479] - x86/microcode/intel: Rename get_datasize() since its used externally (Waiman Long) [RHEL-132479] - x86/microcode: Make reload_early_microcode() static (Waiman Long) [RHEL-132479] - x86/microcode: Include vendor headers into microcode.h (Waiman Long) [RHEL-132479] - x86/microcode/intel: Move microcode functions out of cpu/intel.c (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Get rid of __find_equiv_id() (Waiman Long) [RHEL-132479] - x86/microcode: Add explicit CPU vendor dependency (Waiman Long) [RHEL-132479] - macvlan: fix possible UAF in macvlan_forward_source() (Hangbin Liu) [RHEL-144120] {CVE-2026-23001} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-131922] - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount (Jocelyn Falempe) [RHEL-148636] - audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd references (Waiman Long) [RHEL-146026] - fs: Add a pool of extra fs->pwd references to fs_struct (Waiman Long) [RHEL-146026] - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143535] {CVE-2025-71085} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930] - NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242] - pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242] - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242] - NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242] - NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242] - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242] - SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242] - NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242] - SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242] - SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242] - SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242] - SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242] - NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242] - NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419] - nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419] - pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419] - NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419] - NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419] - NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419] - NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419] - NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419] - NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419] - NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419] - NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419] - NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419] - nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419] - nfs: always check dreq->error after a commit (Mike Snitzer) [RHEL-156419] - nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419] - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231} - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942] - x86/microcode/AMD: Revert "Backport AMD microcode commits for better microcode loading support" (Waiman Long) [RHEL-155860] - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150398] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150398] - tcp: fix forever orphan socket caused by tcp_abort (Paolo Abeni) [RHEL-146187] - xfs: fix minimum agno handling for xfs alloc modes in RHEL8 (Brian Foster) [RHEL-102464] - xfs: fix uninitialized use of flags variable in xfs_alloc_vextent() (Brian Foster) [RHEL-102464] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82523] - tcp: use this_cpu_read(*X) instead of *this_cpu_ptr(X) (Davide Caratti) [RHEL-82523] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150221] - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150221] {CVE-2026-23209} - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) [RHEL-96016] - s390/kexec: Emit an error message when cmdline is too long (Mete Durlu) [RHEL-144946] - s390/boot: Fix kernel size in bootparm area (Mete Durlu) [RHEL-144946] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-137123] - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-151614] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove useless transaction in evict_linked_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-151614] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-151614] - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146419] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146419] {CVE-2025-38323} - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136288] - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136288] - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136288] - scsi: st: Tighten the page format heuristics with MODE SELECT (John Meneghini) [RHEL-136288] - scsi: st: ERASE does not change tape location (John Meneghini) [RHEL-136288] - scsi: st: Fix array overflow in st_setup() (John Meneghini) [RHEL-136288] - scsi: st: Add sysfs file position_lost_in_reset (John Meneghini) [RHEL-136288] - scsi: st: Modify st.c to use the new scsi_error counters (John Meneghini) [RHEL-136288] - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (John Meneghini) [RHEL-136288] - scsi: st: Restore some drive settings after reset (John Meneghini) [RHEL-136288] - scsi: st: Fix input/output error on empty drive reset (John Meneghini) [RHEL-136288] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930] - NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242] - pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242] - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242] - NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242] - NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242] - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242] - SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242] - NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242] - SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242] - SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242] - SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242] - SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242] - NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242] - NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419] - nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419] - pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419] - NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419] - NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419] - NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419] - NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419] - NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419] - NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419] - NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419] - NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419] - NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419] - nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419] - nfs: always check dreq->error after a commit (Mike Snitzer) [RHEL-156419] - nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419] - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231} - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942] - xfrm: esp: avoid in-place decrypt on shared skb frags - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772] - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772] - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772] - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772] - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772] - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772] - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709} - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815] - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815] - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815] - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190} - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408} - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684} - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032] - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032] - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032] - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032] - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032] - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032] - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032] - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032] - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032] - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183} - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219] - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219] - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219] - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219] - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219] - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219] - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219] - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347} - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243} - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890] - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890] - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890] - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890] - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890] - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890] - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890] - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613} - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961] - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858} - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392} - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781} - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990} - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772] - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772] - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772] - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772] - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772] - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772] - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709} - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815] - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815] - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815] - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190} - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408} - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684} - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032] - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032] - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032] - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032] - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032] - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032] - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032] - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032] - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032] - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183} - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219] - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219] - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219] - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219] - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219] - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219] - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219] - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347} - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243} - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890] - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890] - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890] - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890] - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890] - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890] - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890] - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613} - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961] - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858} - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392} - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781} - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990} - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772] - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772] - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772] - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772] - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772] - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772] - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709} - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815] - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815] - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815] - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190} - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408} - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684} - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032] - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032] - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032] - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032] - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032] - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032] - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032] - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032] - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032] - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183} - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219] - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219] - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219] - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219] - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219] - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219] - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219] - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347} - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243} - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890] - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890] - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890] - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890] - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890] - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890] - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890] - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613} - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961] - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858} - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392} - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781} - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - [rt] build kernel-rt-4.18.0-553.16.1.rt7.357.el8_10 [RHEL-44553] - x86/bhi: Fix incorrect CLEAR_BRANCH_HISTORY position in entry_INT80_compat (Waiman Long) [RHEL-50648] - [rt] build kernel-rt-4.18.0-553.15.1.rt7.356.el8_10 [RHEL-44553] - Revert "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-44613] - ionic: fix use after netif_napi_del() (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - ionic: clean interrupt before enabling queue to avoid credit race (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change (CKI Backport Bot) [RHEL-49321] {CVE-2021-47624} - xhci: Handle TD clearing for multiple streams case (CKI Backport Bot) [RHEL-47882] {CVE-2024-40927} - net: openvswitch: Fix Use-After-Free in ovs_ct_exit (cki-backport-bot) [RHEL-36362] {CVE-2024-27395} - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: fix vlan use-after-free (cki-backport-bot) [RHEL-43721] {CVE-2024-36979} - irqchip/gic-v3-its: Prevent double free on error (Charles Mirabile) [RHEL-37022] {CVE-2024-35847} - irqchip/gic-v3-its: Fix potential VPE leak on error (Charles Mirabile) [RHEL-37744] {CVE-2021-47373} - i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() (Charles Mirabile) [RHEL-34735] {CVE-2022-48632} - iommu/dma: fix zeroing of bounce buffer padding used by untrusted devices (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: remove alloc_size argument to swiotlb_tbl_map_single() (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: fix swiotlb_bounce() to do partial sync's correctly (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Reinstate page-alignment for mappings >= PAGE_SIZE (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix alignment checks when both allocation and DMA masks are present (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix double-allocation of slots due to broken alignment handling (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (cki-backport-bot) [RHEL-44441] {CVE-2024-31076} - [rt] build kernel-rt-4.18.0-553.14.1.rt7.355.el8_10 [RHEL-44553] - s390/qeth: Fix kernel panic after setting hsuid (Mete Durlu) [RHEL-49754] - perf/core: Protect event sibling list locking against interrupt inversion (Daniel Vacek) [RHEL-31798] - vt: fix unicode buffer corruption when deleting characters (Steve Best) [RHEL-36936] {CVE-2024-35823} - cifs: translate network errors on send to -ECONNABORTED (Paulo Alcantara) [RHEL-36754] - xfs: don't block in busy flushing when freeing extents (Brian Foster) [RHEL-7984] - xfs: allow extent free intents to be retried (Brian Foster) [RHEL-7984] - xfs: pass alloc flags through to xfs_extent_busy_flush() (Brian Foster) [RHEL-7984] - xfs: use deferred frees for btree block freeing (Brian Foster) [RHEL-7984] - xfs: fix bounds check in xfs_defer_agfl_block() (Brian Foster) [RHEL-7984] - xfs: validate block number being freed before adding to xefi (Brian Foster) [RHEL-7984] - xfs: rename xfs_bmap_add_free to xfs_free_extent_later (Brian Foster) [RHEL-7984] - usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (Desnes Nunes) [RHEL-36803] {CVE-2024-35790} - stm class: Fix a double free in stm_register_device() (Steve Best) [RHEL-44514] {CVE-2024-38627} - s390/qeth: Fix potential loss of L3-IP@ in case of network issues (Mete Durlu) [RHEL-49755] - tls: fix missing memory barrier in tls_init (cki-backport-bot) [RHEL-44471] {CVE-2024-36489} - xfs: fix log recovery buffer allocation for the legacy h_size fixup (Bill O'Donnell) [RHEL-46473] {CVE-2024-39472} - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: use __for_each_thread() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - exit: Use the correct exit_code in /proc/<pid>/stat (Brian Foster) [RHEL-31562] {CVE-2024-26686} - scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool (Ewan D. Milne) [RHEL-38283] {CVE-2023-52811} - scsi: qla2xxx: Fix double free of fcport (Ewan D. Milne) [RHEL-39549] {CVE-2024-26929} - scsi: qla2xxx: Fix double free of the ha->vp_map pointer (Ewan D. Milne) [RHEL-39549] {CVE-2024-26930} - scsi: qla2xxx: Fix command flush on cable pull (Ewan D. Milne) [RHEL-39549] {CVE-2024-26931} - [rt] build kernel-rt-4.18.0-553.13.1.rt7.354.el8_10 [RHEL-44553] - redhat: remove handling of deleted rhdocs/ directory from genspec.sh (Denys Vlasenko) - x86/bugs: Fix BHI retpoline check (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI handling of RRSBA (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr' (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI documentation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix return type of spectre_bhi_state() (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Make CONFIG_SPECTRE_BHI_ON the default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Mitigate KVM by default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add BHI mitigation knob (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Enumerate Branch History Injection (BHI) bug (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Define SPEC_CTRL_BHI_DIS_S (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add support for clearing branch history at syscall entry (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file (Waiman Long) [RHEL-28202] - perf/x86/amd/lbr: Use freeze based on availability (Waiman Long) [RHEL-28202] - Documentation/kernel-parameters: Add spec_rstack_overflow to mitigations=off (Waiman Long) [RHEL-28202] - KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace (Waiman Long) [RHEL-28202] - x86/bugs: Reset speculation control settings on init (Waiman Long) [RHEL-28202] - KVM: x86: Update KVM-only leaf handling to allow for 100% KVM-only leafs (Waiman Long) [RHEL-28202] - KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest (Waiman Long) [RHEL-28202] - mptcp: ensure snd_nxt is properly initialized on connect (Davide Caratti) [RHEL-39865] {CVE-2024-36889} - powerpc/pseries: Enforce hcall result buffer validity and size (Mamatha Inamdar) [RHEL-48291] {CVE-2024-40974} - wifi: mac80211: fix potential key use-after-free (Jose Ignacio Tornos Martinez) [RHEL-28007] {CVE-2023-52530} - cppc_cpufreq: Fix possible null pointer dereference (Mark Langsdorf) [RHEL-44137] {CVE-2024-38573} - net/sched: act_mirred: use the backlog for mirred ingress (Davide Caratti) [RHEL-31718] {CVE-2024-26740} - vfio/pci: Lock external INTx masking ops (Alex Williamson) [RHEL-31922] {CVE-2024-26810} - net: sched: sch_multiq: fix possible OOB write in multiq_tune() (Davide Caratti) [RHEL-43464] {CVE-2024-36978} - tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized (Guillaume Nault) [RHEL-37850] {CVE-2021-47304} - pstore/ram: Fix crash when setting number of cpus to an odd number (Lenny Szubowicz) [RHEL-29471] {CVE-2023-52619} - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node (Jocelyn Falempe) [RHEL-37101] {CVE-2023-52662} - drm/vmwgfx: Fix the lifetime of the bo cursor memory (Jocelyn Falempe) [RHEL-36962] {CVE-2024-35810} - drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed (Jocelyn Falempe) [RHEL-34987] {CVE-2024-26940} - drm/vmwgfx: Unmap the surface before resetting it on a plane state (Jocelyn Falempe) [RHEL-35217] {CVE-2023-52648} - drm/vmwgfx: Fix invalid reads in fence signaled events (Jocelyn Falempe) [RHEL-40010] {CVE-2024-36960} - block: Fix wrong offset in bio_truncate() (Ming Lei) [RHEL-43782] {CVE-2022-48747} - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CKI Backport Bot) [RHEL-46913] {CVE-2024-39487} - net: fix __dst_negative_advice() race (Xin Long) [RHEL-41183] {CVE-2024-36971} - igc: avoid returning frame twice in XDP_REDIRECT (Corinna Vinschen) [RHEL-33264] {CVE-2024-26853} - mac802154: fix llsec key resources release in mac802154_llsec_key_del (Steve Best) [RHEL-34967] {CVE-2024-26961} - cpufreq: exit() callback is optional (Mark Langsdorf) [RHEL-43840] {CVE-2024-38615} - cifs: prevent infinite recursion in CIFSGetDFSRefer() (Paulo Alcantara) [RHEL-34672] - cifs: lock chan_lock outside match_session (Paulo Alcantara) [RHEL-34672] - smb3: workaround negprot bug in some Samba servers (Paulo Alcantara) [RHEL-34672] - smb3: use netname when available on secondary channels (Paulo Alcantara) [RHEL-34672] - smb3: fix empty netname context on secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: populate empty hostnames for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: always iterate smb sessions using primary channel (Paulo Alcantara) [RHEL-34672] - cifs: Fix connections leak when tlink setup failed (Paulo Alcantara) [RHEL-34672] - cifs: Fix memory leak when build ntlmssp negotiate blob failed (Paulo Alcantara) [RHEL-34672] - cifs: always initialize struct msghdr smb_msg completely (Paulo Alcantara) [RHEL-34672] - cifs: don't send down the destination address to sendmsg for a SOCK_STREAM (Paulo Alcantara) [RHEL-34672] - cifs: revalidate mapping when doing direct writes (Paulo Alcantara) [RHEL-34672] - cifs: skip extra NULL byte in filenames (Paulo Alcantara) [RHEL-34672] - cifs: list_for_each() -> list_for_each_entry() (Paulo Alcantara) [RHEL-34672] - smb2: small refactor in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - cifs: Fix crash on unload of cifs_arc4.ko (Paulo Alcantara) [RHEL-34672] - cifs: remove check of list iterator against head past the loop body (Paulo Alcantara) [RHEL-34672] - cifs: fix reconnect on smb3 mount types (Paulo Alcantara) [RHEL-34672] - cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (Paulo Alcantara) [RHEL-34672] - cifs: skip trailing separators of prefix paths (Paulo Alcantara) [RHEL-34672] - cifs: fix ntlmssp on old servers (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL ptr dereference in refresh_mounts() (Paulo Alcantara) [RHEL-34672] - cifs: do not skip link targets when an I/O fails (Paulo Alcantara) [RHEL-34672] - cifs: fix confusing unneeded warning message on smb2.1 and earlier (Paulo Alcantara) [RHEL-34672] - smb3: fix snapshot mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix workstation_name for multiuser mounts (Paulo Alcantara) [RHEL-34672] - cifs: alloc_path_with_tree_prefix: do not append sep. if the path is empty (Paulo Alcantara) [RHEL-34672] - cifs: free ntlmsspblob allocated in negotiate (Paulo Alcantara) [RHEL-34672] - cifs: avoid use of dstaddr as key for fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: add server conn_id to fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: fix missed refcounting of ipc tcon (Paulo Alcantara) [RHEL-34672] - smb2: clarify rc initialization in smb2_reconnect (Paulo Alcantara) [RHEL-34672] - cifs: populate server_hostname for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should be set on new server (Paulo Alcantara) [RHEL-34672] - cifs: introduce cifs_ses_mark_for_reconnect() helper (Paulo Alcantara) [RHEL-34672] - cifs: protect srv_count with cifs_tcp_ses_lock (Paulo Alcantara) [RHEL-34672] - cifs: move debug print out of spinlock (Paulo Alcantara) [RHEL-34672] - cifs: do not duplicate fscache cookie for secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: connect individual channel servers to primary channel server (Paulo Alcantara) [RHEL-34672] - cifs: protect session channel fields with chan_lock (Paulo Alcantara) [RHEL-34672] - cifs: do not negotiate session if session already exists (Paulo Alcantara) [RHEL-34672] - smb3: do not setup the fscache_super_cookie until fsinfo initialized (Paulo Alcantara) [RHEL-34672] - cifs: fix potential use-after-free bugs (Paulo Alcantara) [RHEL-34672] - cifs: release lock earlier in dequeue_mid error case (Paulo Alcantara) [RHEL-34672] - smb3: remove trivial dfs compile warning (Paulo Alcantara) [RHEL-34672] - cifs: support nested dfs links over reconnect (Paulo Alcantara) [RHEL-34672] - cifs: for compound requests, use open handle if possible (Paulo Alcantara) [RHEL-34672] - cifs: split out dfs code from cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant (Paulo Alcantara) [RHEL-34672] - cifs: introduce new helper for cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: fix print of hdr_flags in dfscache_proc_show() (Paulo Alcantara) [RHEL-34672] - cifs: send workstation name during ntlmssp session setup (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should not share socket with future sessions (Paulo Alcantara) [RHEL-34672] - smb3: add dynamic trace points for socket connection (Paulo Alcantara) [RHEL-34672] - cifs: Move SMB2_Create definitions to the shared area (Paulo Alcantara) [RHEL-34672] - cifs: Move more definitions into the shared area (Paulo Alcantara) [RHEL-34672] - cifs: move NEGOTIATE_PROTOCOL definitions out into the common area (Paulo Alcantara) [RHEL-34672] - cifs: Create a new shared file holding smb2 pdu definitions (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect check for null pointer in header_assemble (Paulo Alcantara) [RHEL-34672] - smb3: correct server pointer dereferencing check to be more consistent (Paulo Alcantara) [RHEL-34672] - cifs: Deal with some warnings from W=1 (Paulo Alcantara) [RHEL-34672] - cifs: fix a sign extension bug (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect kernel doc comments (Paulo Alcantara) [RHEL-34672] - cifs: remove pathname for file from SPDX header (Paulo Alcantara) [RHEL-34672] - cifs: move SMB FSCTL definitions to common code (Paulo Alcantara) [RHEL-34672] - cifs: rename cifs_common to smbfs_common (Paulo Alcantara) [RHEL-34672] - cifs: update FSCTL definitions (Paulo Alcantara) [RHEL-34672] - cifs: cifs_md4 convert to SPDX identifier (Paulo Alcantara) [RHEL-34672] - cifs: create a MD4 module and switch cifs.ko to use it (Paulo Alcantara) [RHEL-34672] - cifs: fork arc4 and create a separate module for it for cifs and other users (Paulo Alcantara) [RHEL-34672] - smb3: fix posix extensions mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix wrong release in sess_alloc_buffer() failed path (Paulo Alcantara) [RHEL-34672] - CIFS: Fix a potencially linear read overflow (Paulo Alcantara) [RHEL-34672] - cifs: use the correct max-length for dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: create sd context must be a multiple of 8 (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp sessions of dfs connections (Paulo Alcantara) [RHEL-34672] - cifs: added WARN_ON for all the count decrements (Paulo Alcantara) [RHEL-34672] - cifs: fix missing null session check in mount (Paulo Alcantara) [RHEL-34672] - cifs: handle reconnect of tcon when there is no cached dfs referral (Paulo Alcantara) [RHEL-34672] - cifs: fix the out of range assignment to bit fields in parse_server_interfaces (Paulo Alcantara) [RHEL-34672] - smb3: fix typo in header file (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: Add support for negotiating signing algorithm (Paulo Alcantara) [RHEL-34672] - cifs: prevent NULL deref in cifs_compose_mount_options() (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL dereference in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - smbdirect: missing rc checks while waiting for rdma events (Paulo Alcantara) [RHEL-34672] - cifs: Avoid field over-reading memcpy() (Paulo Alcantara) [RHEL-34672] - smb311: remove dead code for non compounded posix query info (Paulo Alcantara) [RHEL-34672] - cifs: fix SMB1 error path in cifs_get_file_info_unix (Paulo Alcantara) [RHEL-34672] - smb3: fix uninitialized value for port in witness protocol move (Paulo Alcantara) [RHEL-34672] - cifs: fix unneeded null check (Paulo Alcantara) [RHEL-34672] - cifs: use SPDX-Licence-Identifier (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in cifs_debug.c (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in smb2misc.c (Paulo Alcantara) [RHEL-34672] - cifs: missed ref-counting smb session in find (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp servers with dfs mounts (Paulo Alcantara) [RHEL-34672] - cifs: set a minimum of 2 minutes for refreshing dfs cache (Paulo Alcantara) [RHEL-34672] - cifs: Remove unused inline function is_sysvol_or_netlogon() (Paulo Alcantara) [RHEL-34672] - cifs: remove duplicated prototype (Paulo Alcantara) [RHEL-34672] - cifs: fix ipv6 formating in cifs_ses_add_channel (Paulo Alcantara) [RHEL-34672] - cifs: fix string declarations and assignments in tracepoints (Paulo Alcantara) [RHEL-34672] - cifs: fix memory leak in smb2_copychunk_range (Paulo Alcantara) [RHEL-34672] - SMB3: incorrect file id in requests compounded with open (Paulo Alcantara) [RHEL-34672] - smb3: if max_channels set to more than one channel request multichannel (Paulo Alcantara) [RHEL-34672] - smb3: do not attempt multichannel to server which does not support it (Paulo Alcantara) [RHEL-34672] - smb3: when mounting with multichannel include it in requested capabilities (Paulo Alcantara) [RHEL-34672] - cifs: simplify SWN code with dummy funcs instead of ifdefs (Paulo Alcantara) [RHEL-34672] - cifs: log mount errors using cifs_errorf() (Paulo Alcantara) [RHEL-34672] - cifs: switch build_path_from_dentry() to using dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: fix out-of-bound memory access when calling smb3_notify() at mount point (Paulo Alcantara) [RHEL-34672] - cifs: allocate buffer in the caller of build_path_from_dentry() (Paulo Alcantara) [RHEL-34672] - cifs: make build_path_from_dentry() return const char * (Paulo Alcantara) [RHEL-34672] - cifs: remove old dead code (Paulo Alcantara) [RHEL-34672] - fs: cifs: Remove repeated struct declaration (Paulo Alcantara) [RHEL-34672] - cifs: have cifs_fattr_to_inode() refuse to change type on live inode (Paulo Alcantara) [RHEL-34672] - cifs: have ->mkdir() handle race with another client sanely (Paulo Alcantara) [RHEL-34672] - do_cifs_create(): don't set ->i_mode of something we had not created (Paulo Alcantara) [RHEL-34672] - cifs: Silently ignore unknown oplock break handle (Paulo Alcantara) [RHEL-34672] - cifs: change noisy error message to FYI (Paulo Alcantara) [RHEL-34672] - cifs: print MIDs in decimal notation (Paulo Alcantara) [RHEL-34672] - cifs: minor simplification to smb2_is_network_name_deleted (Paulo Alcantara) [RHEL-34672] - TCON Reconnect during STATUS_NETWORK_NAME_DELETED (Paulo Alcantara) [RHEL-34672] - cifs: clarify hostname vs ip address in /proc/fs/cifs/DebugData (Paulo Alcantara) [RHEL-34672] - cifs: change confusing field serverName (to ip_addr) (Paulo Alcantara) [RHEL-34672] - cifs: Reformat DebugData and index connections by conn_id. (Paulo Alcantara) [RHEL-34672] - cifs: Identify a connection by a conn_id. (Paulo Alcantara) [RHEL-34672] - smb3: negotiate current dialect (SMB3.1.1) when version 3 or greater requested (Paulo Alcantara) [RHEL-34672] - smb3: Fix out-of-bounds bug in SMB2_negotiate() (Paulo Alcantara) [RHEL-34672] - fs/cifs: Simplify bool comparison. (Paulo Alcantara) [RHEL-34672] - fs/cifs: Assign boolean values to a bool variable (Paulo Alcantara) [RHEL-34672] - cifs: Avoid error pointer dereference (Paulo Alcantara) [RHEL-34672] - cifs: Re-indent cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Unlock on errors in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Delete a stray unlock in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Tracepoints and logs for tracing credit changes. (Paulo Alcantara) [RHEL-34672] - cifs: Fix some error pointers handling detected by static checker (Paulo Alcantara) [RHEL-34672] - smb3: remind users that witness protocol is experimental (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: do not log warning message if server doesn't populate salt (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: update comments clarifying SPNEGO info in negprot response (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot rsp (Paulo Alcantara) [RHEL-34672] - SMB3: avoid confusing warning message on mount to Azure (Paulo Alcantara) [RHEL-34672] - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (Nigel Croxon) [RHEL-46662] {CVE-2024-39476} - net: fix information leakage in /proc/net/ptype (Hangbin Liu) [RHEL-44000] {CVE-2022-48757} - usb: typec: ucsi: Limit read size on v1.2 (Desnes Nunes) [RHEL-37286] {CVE-2024-35924} - minmax: relax check to allow comparison between unsigned arguments and signed constants (Desnes Nunes) [RHEL-37286] - minmax: allow comparisons of 'int' against 'unsigned char/short' (Desnes Nunes) [RHEL-37286] - minmax: allow min()/max()/clamp() if the arguments have the same signedness. (Desnes Nunes) [RHEL-37286] - minmax: add umin(a, b) and umax(a, b) (Desnes Nunes) [RHEL-37286] - minmax: fix header inclusions (Desnes Nunes) [RHEL-37286] - minmax: clamp more efficiently by avoiding extra comparison (Desnes Nunes) [RHEL-37286] - minmax: sanity check constant bounds when clamping (Desnes Nunes) [RHEL-37286] - tracing: Define the is_signed_type() macro once (Desnes Nunes) [RHEL-37286] - linux/bits.h: fix compilation error with GENMASK (Desnes Nunes) [RHEL-37286] - x86/apic: Mask IOAPIC entries when disabling the local APIC (Lenny Szubowicz) [RHEL-18077] - userfaultfd: fix a race between writeprotect and exit_mmap() (Rafael Aquini) [RHEL-38410] {CVE-2021-47461} - mm: khugepaged: skip huge page collapse for special files (Waiman Long) [RHEL-38446] {CVE-2021-47491} - cachefiles: fix memory leak in cachefiles_add_cache() (Andrey Albershteyn) [RHEL-33109] {CVE-2024-26840} - drm/amd/display: Implement bounds check for stream encoder creation in DCN301 (Michel Dänzer) [RHEL-31429] {CVE-2024-26660} - net/mlx5: Discard command completions in internal error (Kamal Heib) [RHEL-44231] {CVE-2024-38555} - drm: Don't unref the same fb many times by mistake due to deadlock handling (CKI Backport Bot) [RHEL-29011] {CVE-2023-52486} - md: fix resync softlockup when bitmap size is less than array size (Nigel Croxon) [RHEL-43942] {CVE-2024-38598} - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation (Davide Caratti) [RHEL-39712] {CVE-2024-36017} - netfilter: nf_tables: discard table flag update with pending basechain deletion (Phil Sutter) [RHEL-37205] {CVE-2024-35897} - netfilter: nf_tables: reject table flag and netdev basechain updates (Phil Sutter) [RHEL-37205] - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (Ewan D. Milne) [RHEL-40172] {CVE-2024-36924} - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (Ewan D. Milne) [RHEL-40172] {CVE-2024-36952} - netfilter: nf_tables: fix memleak in map from abort path (Phil Sutter) [RHEL-35052] {CVE-2024-27011} - netfilter: nf_tables: reject new basechain after table flag update (Phil Sutter) [RHEL-37193] {CVE-2024-35900} - netfilter: nf_tables: flush pending destroy work before exit_net release (Phil Sutter) [RHEL-37197] {CVE-2024-35899} - netfilter: complete validation of user input (Phil Sutter) [RHEL-37210] - netfilter: validate user input for expected length (Phil Sutter) [RHEL-37210] {CVE-2024-35896} - netfilter: tproxy: bail out if IP has been disabled on the device (Phil Sutter) [RHEL-44363] {CVE-2024-36270} - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (Phil Sutter) [RHEL-44532] {CVE-2024-36286} - netfilter: nf_tables: do not compare internal table flags on updates (Phil Sutter) [RHEL-35114] {CVE-2024-27065} - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (Phil Sutter) [RHEL-35028] {CVE-2024-27019} - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (Phil Sutter) [RHEL-35024] {CVE-2024-27020} - netfilter: nf_tables: __nft_expr_type_get() selects specific family type (Phil Sutter) [RHEL-35024] - netfilter: conntrack: serialize hash resizes and cleanups (Phil Sutter) [RHEL-37703] {CVE-2021-47408} - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (Phil Sutter) [RHEL-34217] {CVE-2024-26925} - netfilter: nf_tables: release batch on table validation from abort path (Phil Sutter) [RHEL-34217] - ipvlan: add ipvlan_route_v6_outbound() helper (Davide Caratti) [RHEL-38319] {CVE-2023-52796} - [rt] build kernel-rt-4.18.0-553.12.1.rt7.353.el8_10 [RHEL-44553] - net: bridge: xmit: make sure we have at least eth header len bytes (cki-backport-bot) [RHEL-44291] {CVE-2024-38538} - drivers/amd/pm: fix a use-after-free in kv_parse_power_table (Michel Dänzer) [RHEL-26893] {CVE-2023-52469} - SUNRPC: Fix a suspicious RCU usage warning (Scott Mayhew) [RHEL-30503] {CVE-2023-52623} - ice: Fix some null pointer dereference issues in ice_ptp.c (Petr Oros) [RHEL-26901] {CVE-2023-52471} - xfs: fix internal error from AGFL exhaustion (Pavel Reichl) [RHEL-45581] - sched/psi: Fix use-after-free in ep_remove_wait_queue() (Phil Auld) [RHEL-38117] {CVE-2023-52707} - wait: add wake_up_pollfree() (Phil Auld) [RHEL-38117] - net/ipv6: avoid possible UAF in ip6_route_mpath_notify() (Hangbin Liu) [RHEL-33269] {CVE-2024-26852} - net: bridge: switchdev: Skip MDB replays of deferred events on offload (Ivan Vecera) [RHEL-33117] {CVE-2024-26837} - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (Pavel Reichl) [RHEL-31700] {CVE-2024-26772} - ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() (Pavel Reichl) [RHEL-31688] {CVE-2024-26773} - ext4: fix double-free of blocks due to wrong extents moved_len (Pavel Reichl) [RHEL-31612] {CVE-2024-26704} - vxlan: Pull inner IP header in vxlan_xmit_one(). (Guillaume Nault) [RHEL-31389] - geneve: Fix incorrect inner network header offset when innerprotoinherit is set (Guillaume Nault) [RHEL-31389] - vxlan: Pull inner IP header in vxlan_rcv(). (Guillaume Nault) [RHEL-31389] - geneve: fix header validation in geneve[6]_xmit_skb (Guillaume Nault) [RHEL-31389] - geneve: make sure to pull inner header in geneve_rx() (Guillaume Nault) [RHEL-31389] - net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb (Guillaume Nault) [RHEL-31389] - net: geneve: check skb is large enough for IPv4/IPv6 header (Guillaume Nault) [RHEL-31389] - net/smc: fix neighbour and rtable leak in smc_ib_find_route() (Tobias Huschle) [RHEL-39744] {CVE-2024-36945} - igb: Fix string truncation warnings in igb_set_fw_version (Corinna Vinschen) [RHEL-38452] {CVE-2024-36010} - bonding: stop the device in bond_setup_by_slave() (Hangbin Liu) [RHEL-38327] {CVE-2023-52784} - i40e: fix vf may be used uninitialized in this function warning (Kamal Heib) [RHEL-39702] {CVE-2024-36020} - powerpc/64: Fix the definition of the fixmap area (Mamatha Inamdar) [RHEL-27191] {CVE-2021-47018} - powerpc/mm/hash64: Add a variable to track the end of IO mapping (Mamatha Inamdar) [RHEL-27191] {CVE-2021-47018} - nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). (Xin Long) [RHEL-39770] {CVE-2024-36933} - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (Xin Long) [RHEL-39770] - net: core: reject skb_copy(_expand) for fraglist GSO skbs (Xin Long) [RHEL-39779] {CVE-2024-36929} - tcp: properly terminate timers for kernel sockets (Guillaume Nault) [RHEL-37171] {CVE-2024-35910} - net: relax socket state check at accept time. (Florian Westphal) [RHEL-39831] - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (Florian Westphal) [RHEL-39831] {CVE-2024-36905} - tcp: remove redundant check on tskb (Florian Westphal) [RHEL-39831] - drm/ast: Fix soft lockup (cki-backport-bot) [RHEL-37438] {CVE-2024-35952} - null_blk: Fix return value of nullb_device_power_store() (Ming Lei) [RHEL-39341] - null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues' (Ming Lei) [RHEL-39341] - null_blk: fix return value from null_add_dev() (Ming Lei) [RHEL-39341] - [rt] build kernel-rt-4.18.0-553.11.1.rt7.352.el8_10 [RHEL-44553] - x86/bugs: Reverse instruction order of CLEAR_CPU_BUFFERS (Waiman Long) [RHEL-42121] - Revert "x86/bugs: Use fixed addressing for VERW operand" (Waiman Long) [RHEL-42121] - KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests (Waiman Long) [RHEL-42121] - x86/rfds: Mitigate Register File Data Sampling (RFDS) (Waiman Long) [RHEL-42121] - Documentation/hw-vuln: Add documentation for RFDS (Waiman Long) [RHEL-42121] - x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set (Waiman Long) [RHEL-42121] - x86/bugs: Use fixed addressing for VERW operand (Waiman Long) [RHEL-42121] - KVM/VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH (Waiman Long) [RHEL-42121] - x86/bugs: Use ALTERNATIVE() instead of mds_user_clear static key (Waiman Long) [RHEL-42121] - x86/entry_32: Add VERW just before userspace transition (Waiman Long) [RHEL-42121] - x86/entry_64: Add VERW just before userspace transition (Waiman Long) [RHEL-42121] - x86/bugs: Add asm helpers for executing VERW (Waiman Long) [RHEL-42121] - x86/cpu: Fix Gracemont uarch (Waiman Long) [RHEL-42121] - Documentation/hw-vuln: Unify filename specification in index (Waiman Long) [RHEL-42121] - KVM: VMX: Access @flags as a 32-bit value in __vmx_vcpu_run() (Waiman Long) [RHEL-42121] - x86/asm: Add _ASM_RIP() macro for x86-64 (%rip) suffix (Waiman Long) [RHEL-42121] - x86/asm: Have the __ASM_FORM macros handle commas in arguments (Waiman Long) [RHEL-42121] - x86/asm: Allow to pass macros to __ASM_FORM() (Waiman Long) [RHEL-42121] - wifi: iwlwifi: mvm: guard against invalid STA ID on removal (Jose Ignacio Tornos Martinez) [RHEL-39801] {CVE-2024-36921} - ipv6: Fix potential uninit-value access in __ip6_make_skb() (Antoine Tenart) [RHEL-39784] - ipv4: Fix uninit-value access in __ip_make_skb() (Antoine Tenart) [RHEL-39784] {CVE-2024-36927} - perf mmap: Lazily initialize zstd streams to save memory when not using it (Michael Petlan) [RHEL-34876] - perf tools: Fix spelling mistake "commpressor" -> "compressor" (Michael Petlan) [RHEL-34876] - perf record: Introduce data transferred and compressed stats (Michael Petlan) [RHEL-34876] - perf record: Introduce compressor at mmap buffer object (Michael Petlan) [RHEL-34876] - perf record: Introduce bytes written stats (Michael Petlan) [RHEL-34876] - perf record: Introduce data file at mmap buffer object (Michael Petlan) [RHEL-34876] - perf record: Start threads in the beginning of trace streaming (Alexey Bayduraev) [RHEL-34876] - perf record: Stop threads in the end of trace streaming (Michael Petlan) [RHEL-34876] - perf record: Introduce thread local variable (Michael Petlan) [RHEL-34876] - perf record: Introduce function to propagate control commands (Michael Petlan) [RHEL-34876] - perf record: Introduce thread specific data array (Michael Petlan) [RHEL-34876] - tools lib: Introduce fdarray duplicate function (Michael Petlan) [RHEL-34876] - perf record: Introduce thread affinity and mmap masks (Michael Petlan) [RHEL-34876] - gfs2: Be more careful with the quota sync generation (Andreas Gruenbacher) [RHEL-40901] - gfs2: Get rid of some unnecessary quota locking (Andreas Gruenbacher) [RHEL-40901] - gfs2: Add some missing quota locking (Andreas Gruenbacher) [RHEL-40901] - gfs2: Fold qd_fish into gfs2_quota_sync (Andreas Gruenbacher) [RHEL-40901] - gfs2: quota need_sync cleanup (Andreas Gruenbacher) [RHEL-40901] - gfs2: Fix and clean up function do_qc (Andreas Gruenbacher) [RHEL-40901] - gfs2: Revert "Add quota_change type" (Andreas Gruenbacher) [RHEL-40901] - gfs2: Revert "ignore negated quota changes" (Andreas Gruenbacher) [RHEL-40901] - gfs2: qd_check_sync cleanups (Andreas Gruenbacher) [RHEL-40901] - gfs2: Check quota consistency on mount (Andreas Gruenbacher) [RHEL-40901] - gfs2: Minor gfs2_quota_init error path cleanup (Andreas Gruenbacher) [RHEL-40901] - gfs2: fix kernel BUG in gfs2_quota_cleanup (Edward Adam Davis) [RHEL-40901] - gfs2: Clean up quota.c:print_message (Andreas Gruenbacher) [RHEL-40901] - gfs2: Clean up gfs2_alloc_parms initializers (Andreas Gruenbacher) [RHEL-40901] - gfs2: Two quota=account mode fixes (Andreas Gruenbacher) [RHEL-40901] - gfs2: Remove useless assignment (Bob Peterson) [RHEL-40901] - gfs2: simplify slot_get (Bob Peterson) [RHEL-40901] - gfs2: Simplify qd2offset (Bob Peterson) [RHEL-40901] - gfs2: Remove quota allocation info from quota file (Bob Peterson) [RHEL-40901] - gfs2: use constant for array size (Bob Peterson) [RHEL-40901] - gfs2: Set qd_sync_gen in do_sync (Bob Peterson) [RHEL-40901] - gfs2: Remove useless err set (Bob Peterson) [RHEL-40901] - gfs2: Small gfs2_quota_lock cleanup (Bob Peterson) [RHEL-40901] - gfs2: move qdsb_put and reduce redundancy (Bob Peterson) [RHEL-40901] - gfs2: Don't try to sync non-changes (Bob Peterson) [RHEL-40901] - gfs2: Simplify function need_sync (Bob Peterson) [RHEL-40901] - gfs2: remove unneeded pg_oflow variable (Bob Peterson) [RHEL-40901] - gfs2: remove unneeded variable done (Bob Peterson) [RHEL-40901] - gfs2: pass sdp to gfs2_write_buf_to_page (Bob Peterson) [RHEL-40901] - gfs2: pass sdp in to gfs2_write_disk_quota (Bob Peterson) [RHEL-40901] - gfs2: Pass sdp to gfs2_adjust_quota (Bob Peterson) [RHEL-40901] - gfs2: remove dead code for quota writes (Bob Peterson) [RHEL-40901] - gfs2: Use qd_sbd more consequently (Bob Peterson) [RHEL-40901] - gfs2: replace 'found' with dedicated list iterator variable (Jakob Koschel) [RHEL-40901] - gfs2: Some whitespace cleanups (Andreas Gruenbacher) [RHEL-40901] - gfs2: Fix gfs2_qa_get imbalance in gfs2_quota_hold (Bob Peterson) [RHEL-40901] - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg (Guillaume Nault) [RHEL-43961] {CVE-2024-38596} - af_unix: Fix data-races around sk->sk_shutdown. (Guillaume Nault) [RHEL-43961] {CVE-2024-38596} - af_unix: Fix data races around sk->sk_shutdown. (Guillaume Nault) [RHEL-43961] {CVE-2024-38596} - perf/core: Fix event sibling list locking (Daniel Vacek) [RHEL-31798] - media: bttv: fix use after free error due to btv->timeout timer (Kate Hsuan) [RHEL-38256] {CVE-2023-52847} - arp: Prevent overflow in arp_req_get(). (Antoine Tenart) [RHEL-31706] {CVE-2024-26733} - Bluetooth: btusb: Add a new PID/VID 0489/e0c8 for MT7921 (David Marlin) [RHEL-10263] - mm: swap: fix race between free_swap_and_cache() and swapoff() (Waiman Long) [RHEL-34971] {CVE-2024-26960} - swap: comments get_swap_device() with usage rule (Waiman Long) [RHEL-34971] {CVE-2024-26960} - mm/swapfile.c: __swap_entry_free() always free 1 entry (Waiman Long) [RHEL-34971] {CVE-2024-26960} - mm/swapfile.c: call free_swap_slot() in __swap_entry_free() (Waiman Long) [RHEL-34971] {CVE-2024-26960} - mm/swapfile.c: use __try_to_reclaim_swap() in free_swap_and_cache() (Waiman Long) [RHEL-34971] {CVE-2024-26960} - net: amd-xgbe: Fix skb data length underflow (Ken Cox) [RHEL-43788] {CVE-2022-48743} - ovl: fix warning in ovl_create_real() (cki-backport-bot) [RHEL-43652] {CVE-2021-47579} - net/sched: initialize noop_qdisc owner (Davide Caratti) [RHEL-35056] - net/sched: Fix mirred deadlock on device recursion (Davide Caratti) [RHEL-35056] {CVE-2024-27010} - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (Pavel Reichl) [RHEL-45029] {CVE-2024-39276} - ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() (Ken Cox) [RHEL-38713] {CVE-2021-47548} - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound (Hangbin Liu) [RHEL-44396] {CVE-2024-33621} - mlxsw: spectrum_acl_tcam: Fix stack corruption (Ivan Vecera) [RHEL-26462] {CVE-2024-26586} - inet: inet_defrag: prevent sk release while still in use (Antoine Tenart) [RHEL-33398] {CVE-2024-26921} - skb_expand_head() adjust skb->truesize incorrectly (Antoine Tenart) [RHEL-33398] - nvmet: fix ns enable/disable possible hang (Ming Lei) [RHEL-43547] - [rt] build kernel-rt-4.18.0-553.10.1.rt7.351.el8_10 [RHEL-44553] - SUNRPC: Fix RPC client cleaned up the freed pipefs dentries (Scott Mayhew) [RHEL-38264] {CVE-2023-52803} - scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() (Ewan D. Milne) [RHEL-39717] {CVE-2024-36025} - tcp: add sanity checks to rx zerocopy (Guillaume Nault) [RHEL-29494] {CVE-2024-26640} - SUNRPC: fix some memleaks in gssx_dec_option_array (Scott Mayhew) [RHEL-35209] {CVE-2024-27388} - wifi: nl80211: don't free NULL coalescing rule (Jose Ignacio Tornos Martinez) [RHEL-39752] {CVE-2024-36941} - nfs: fix UAF in direct writes (Scott Mayhew) [RHEL-34975] {CVE-2024-26958} - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 (Scott Mayhew) [RHEL-33228] {CVE-2024-26870} - drm/amd/pm: Fix error of MACO flag setting code (Michel Dänzer) [RHEL-15928] - scsi: aacraid: fix io hangs and improve performance (John Meneghini) [RHEL-23913] - block: prevent division by zero in blk_rq_stat_sum() (Ming Lei) [RHEL-37279] {CVE-2024-35925} - block: fix overflow in blk_ioctl_discard() (Ming Lei) [RHEL-39811] {CVE-2024-36917} - virtio-blk: fix implicit overflow on virtio_max_dma_size (Ming Lei) [RHEL-38131] {CVE-2023-52762} - nbd: null check for nla_nest_start (Ming Lei) [RHEL-35176] {CVE-2024-27025} - isdn: mISDN: netjet: Fix crash in nj_probe: (Ken Cox) [RHEL-38444] {CVE-2021-47284} - isdn: mISDN: Fix sleeping function called from invalid context (Ken Cox) [RHEL-38400] {CVE-2021-47468} - net/smc: avoid data corruption caused by decline (Tobias Huschle) [RHEL-38234] {CVE-2023-52775} - ubi: Check for too small LEB size in VTBL code (David Arcari) [RHEL-25092] {CVE-2024-25739} - i2c: core: Fix atomic xfer check for non-preempt config (Steve Best) [RHEL-38313] {CVE-2023-52791} - i2c: core: Run atomic i2c xfer when !preemptible (Steve Best) [RHEL-38313] {CVE-2023-52791} - firewire: ohci: mask bus reset interrupts between ISR and bottom half (Steve Best) [RHEL-39902] {CVE-2024-36950} - ipv6: init the accept_queue's spinlocks in inet6_create (Guillaume Nault) [RHEL-28899] {CVE-2024-26614} - tcp: make sure init the accept_queue's spinlocks once (Guillaume Nault) [RHEL-28899] {CVE-2024-26614} - tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (Steve Best) [RHEL-39352] {CVE-2024-36016} - mlxsw: spectrum_acl_tcam: Fix incorrect list API usage (Ivan Vecera) [RHEL-37484] {CVE-2024-36006} - pwm: Fix double shift bug (Steve Best) [RHEL-38278] {CVE-2023-52756} - mmc: sdio: fix possible resource leaks in some error paths (Steve Best) [RHEL-38149] {CVE-2023-52730} - of: unittest: Fix compile in the non-dynamic case (Steve Best) [RHEL-37070] {CVE-2023-52679} - of: unittest: Fix of_count_phandle_with_args() expected value message (Steve Best) [RHEL-37070] {CVE-2023-52679} - of: Fix double free in of_parse_phandle_with_args_map (Steve Best) [RHEL-37070] {CVE-2023-52679} - pinctrl: core: delete incorrect free in pinctrl_enable() (Steve Best) [RHEL-39756] {CVE-2024-36940} - pinctrl: core: fix possible memory leak in pinctrl_enable() (Steve Best) [RHEL-39756] {CVE-2024-36940} - media: gspca: cpia1: shift-out-of-bounds in set_flicker (Desnes Nunes) [RHEL-38331] {CVE-2023-52764} - tipc: fix a possible memleak in tipc_buf_append (Xin Long) [RHEL-39881] {CVE-2024-36954} - cifs: fix mid leak during reconnection after timeout threshold (Paulo Alcantara) [RHEL-36222] - cifs: Fix use-after-free in rdata->read_into_pages() (Paulo Alcantara) [RHEL-36222] - cifs: Fix pages leak when writedata alloc failed in cifs_write_from_iter() (Paulo Alcantara) [RHEL-36222] - cifs: Fix pages array leak when writedata alloc failed in cifs_writedata_alloc() (Paulo Alcantara) [RHEL-36222] - cifs: destage dirty pages before re-reading them for cache=none (Paulo Alcantara) [RHEL-36222] - cifs: destage any unwritten data to the server before calling copychunk_write (Paulo Alcantara) [RHEL-36222] - Adjust cifssb maximum read size (Paulo Alcantara) [RHEL-36222] - cifs: make locking consistent around the server session status (Paulo Alcantara) [RHEL-36222] - cifs: fix credit accounting for extra channel (Paulo Alcantara) [RHEL-36222] - smb3: prevent races updating CurrentMid (Paulo Alcantara) [RHEL-36222] - cifs: fix missing spinlock around update to ses->status (Paulo Alcantara) [RHEL-36222] - cifs: use echo_interval even when connection not ready. (Paulo Alcantara) [RHEL-36222] - cifs: detect dead connections only when echoes are enabled. (Paulo Alcantara) [RHEL-36222] - cifs: Fix preauth hash corruption (Paulo Alcantara) [RHEL-36222] - cifs: do not send close in compound create+close requests (Paulo Alcantara) [RHEL-36222] - cifs: ask for more credit on async read/write code paths (Paulo Alcantara) [RHEL-36222] - cifs: use discard iterator to discard unneeded network data more efficiently (Paulo Alcantara) [RHEL-36222] - cifs: Fix in error types returned for out-of-credit situations. (Paulo Alcantara) [RHEL-36222] - smb3: fix crediting for compounding when only one request in flight (Paulo Alcantara) [RHEL-36222] - cifs: New optype for session operations. (Paulo Alcantara) [RHEL-36222] - mm/gup: do not return 0 from pin_user_pages_fast() for bad args (Paulo Alcantara) [RHEL-36222] - wifi: brcmfmac: pcie: handle randbuf allocation failure (Jose Ignacio Tornos Martinez) [RHEL-44124] {CVE-2024-38575} - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). (Guillaume Nault) [RHEL-39835] {CVE-2024-36904} - wifi: mac80211: don't return unset power in ieee80211_get_tx_power() (Jose Ignacio Tornos Martinez) [RHEL-38159] {CVE-2023-52832} - wifi: ath11k: fix gtk offload status event locking (Jose Ignacio Tornos Martinez) [RHEL-38155] {CVE-2023-52777} - net: ieee802154: fix null deref in parse dev addr (Steve Best) [RHEL-38012] {CVE-2021-47257} - mm/hugetlb: fix missing hugetlb_lock for resv uncharge (Rafael Aquini) [RHEL-37465] {CVE-2024-36000} - x86/xen: Add some null pointer checking to smp.c (Vitaly Kuznetsov) [RHEL-33258] {CVE-2024-26908} - x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() (Vitaly Kuznetsov) [RHEL-33258] {CVE-2024-26908} - wifi: cfg80211: check A-MSDU format more carefully (Jose Ignacio Tornos Martinez) [RHEL-37343] {CVE-2024-35937} - wifi: rtw89: fix null pointer access when abort scan (Jose Ignacio Tornos Martinez) [RHEL-37355] {CVE-2024-35946} - atl1c: Work around the DMA RX overflow issue (Ken Cox) [RHEL-38287] {CVE-2023-52834} - wifi: ath11k: decrease MHI channel buffer length to 8KB (Jose Ignacio Tornos Martinez) [RHEL-37339] {CVE-2024-35938} - wifi: iwlwifi: mvm: rfi: fix potential response leaks (Jose Ignacio Tornos Martinez) [RHEL-37163] {CVE-2024-35912} - USB: core: Fix access violation during port device removal (Desnes Nunes) [RHEL-39853] {CVE-2024-36896} - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() (Ewan D. Milne) [RHEL-37123] {CVE-2024-35930} - netfilter: nf_tables: honor table dormant flag from netdev release event path (Phil Sutter) [RHEL-37450] {CVE-2024-36005} - wifi: iwlwifi: mvm: don't set the MFP flag for the GTK (Jose Ignacio Tornos Martinez) [RHEL-36898] {CVE-2024-27434} - wifi: iwlwifi: mvm: Fix key flags for IGTK on AP interface (Jose Ignacio Tornos Martinez) [RHEL-36898] {CVE-2024-27434} - misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspend/resume (Steve Best) [RHEL-36932] {CVE-2024-35824} - [rt] build kernel-rt-4.18.0-553.9.1.rt7.350.el8_10 [RHEL-44553] - x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (Steve Best) [RHEL-37262] {CVE-2024-35876} - net/sched: flower: Fix chain template offload (Xin Long) [RHEL-31313] {CVE-2024-26669} - SUNRPC: fix a memleak in gss_import_v2_context (Scott Mayhew) [RHEL-35195] {CVE-2023-52653} - efivarfs: force RO when remounting if SetVariable is not supported (Pavel Reichl) [RHEL-26564] {CVE-2023-52463} - dmaengine: idxd: add a write() method for applications to submit work (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823} - dmaengine: idxd: add a new security check to deal with a hardware erratum (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823} - VFIO: Add the SPR_DSA and SPR_IAX devices to the denylist (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823} - quota: Fix potential NULL pointer dereference (Pavel Reichl) [RHEL-33219] {CVE-2024-26878} - locking/lockdep: Fix overflow in presentation of average lock-time (Čestmír Kalina) [RHEL-17678] - blk-cgroup: Properly propagate the iostat update up the hierarchy (Ming Lei) [RHEL-40939] - proc: Use new_inode not new_inode_pseudo (Ian Kent) [RHEL-40167] - stmmac: Clear variable when destroying workqueue (Izabela Bakollari) [RHEL-31822] {CVE-2024-26802} - powerpc/pseries/memhp: Fix access beyond end of drmem array (Mamatha Inamdar) [RHEL-26495] {CVE-2023-52451} - platform/x86: wmi: Fix opening of char device (David Arcari) [RHEL-38258] {CVE-2023-52864} - Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" (Kamal Heib) [RHEL-36908] {CVE-2023-52658} - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed (Cathy Avery) [RHEL-39074] - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove (Cathy Avery) [RHEL-39074] - hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes (Cathy Avery) [RHEL-39074] - hv_netvsc: remove duplicated including of slab.h (Cathy Avery) [RHEL-39074] - hv_netvsc: rndis_filter needs to select NLS (Cathy Avery) [RHEL-39074] - hv_netvsc: Mark VF as slave before exposing it to user-mode (Cathy Avery) [RHEL-39074] - hv_netvsc: Fix race of register_netdevice_notifier and VF register (Cathy Avery) [RHEL-39074] - hv_netvsc: fix race of netvsc and VF register_netdevice (Cathy Avery) [RHEL-39074] - hv_netvsc: fix netvsc_send_completion to avoid multiple message length checks (Cathy Avery) [RHEL-39074] - hv_netvsc: Allocate rx indirection table size dynamically (Cathy Avery) [RHEL-39074] - net: hv_netvsc: Fix a warning triggered by memcpy in rndis_filter (Cathy Avery) [RHEL-39074] - gfs2: Fix lru_count accounting (Andreas Gruenbacher) [RHEL-32941] - gfs2: Fix "Make glock lru list scanning safer" (Andreas Gruenbacher) [RHEL-32941] - gfs2: Fix "ignore unlock failures after withdraw" (Andreas Gruenbacher) [RHEL-32941] - gfs2: Don't set GLF_LOCK in gfs2_dispose_glock_lru (Andreas Gruenbacher) [RHEL-32941] - gfs2: Don't forget to complete delayed withdraw (Andreas Gruenbacher) [RHEL-32941] - gfs2: Delay withdraw from atomic context (Andreas Gruenbacher) [RHEL-32941] - gfs2: trivial clean up of gfs2_ail_error (Andreas Gruenbacher) [RHEL-32941] - ext4: fix corruption during on-line resize (Carlos Maiolino) [RHEL-36974] {CVE-2024-35807} - ext4: correct offset of gdb backup in non meta_bg group to update_backups (Carlos Maiolino) [RHEL-36974] - ext4: avoid online resizing failures due to oversized flex bg (Carlos Maiolino) [RHEL-30507] {CVE-2023-52622} - ext4: use time_is_before_jiffies() instead of open coding it (Carlos Maiolino) [RHEL-30507] - ext4: unify the type of flexbg_size to unsigned int (Carlos Maiolino) [RHEL-30507] - ext4: remove unnecessary check from alloc_flex_gd() (Carlos Maiolino) [RHEL-30507] - tracing: Do no increment trace_clock_global() by one (Jerome Marchand) [RHEL-27107] {CVE-2021-46939} - tracing: Restructure trace_clock_global() to never block (Jerome Marchand) [RHEL-27107] {CVE-2021-46939} - net/sched: act_skbmod: prevent kernel-infoleak (Xin Long) [RHEL-37220] {CVE-2024-35893} - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (Xin Long) [RHEL-38307] {CVE-2023-52845} - redhat: remove the merge subtrees script (Derek Barbosa) - redhat: rhdocs: delete .get_maintainer.conf (Derek Barbosa) - redhat: rhdocs: Remove the rhdocs directory (Derek Barbosa) - dyndbg: fix old BUG_ON in >control parser (Waiman Long) [RHEL-37111] {CVE-2024-35947} - dyndbg: let query-modname override actual module name (Waiman Long) [RHEL-37111] - dyndbg: make dyndbg a known cli param (Waiman Long) [RHEL-37111] - lan78xx: Fix exception on link speed change (Jamie Bainbridge) [RHEL-33437] - net: usb: lan78xx: don't modify phy_device state concurrently (Jamie Bainbridge) [RHEL-33437] - efi: runtime: Fix potential overflow of soft-reserved region size (Lenny Szubowicz) [RHEL-33096] {CVE-2024-26843} - perf/arm-cmn: Fail DTC counter allocation correctly (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Rework DTC counters (again) (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Fix DTC domain detection (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Revamp model detection (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Fix port detection for CMN-700 (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Move overlapping wp_combine field (Michael Petlan) [RHEL-23841] - Partially revert "perf/arm-cmn: Optimise DTC counter accesses" (Michael Petlan) [RHEL-23841] - drivers/perf: Compile with gnu99 standard (Michael Petlan) [RHEL-23841] - x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (Steve Best) [RHEL-36994] {CVE-2024-35801} - watchdog: softdog: Add options 'soft_reboot_cmd' and 'soft_active_on_boot' (Waiman Long) [RHEL-19723] - tipc: fix UAF in error path (Xin Long) [RHEL-34278] {CVE-2024-36886} - [rt] build kernel-rt-4.18.0-553.8.1.rt7.349.el8_10 [RHEL-40882] - udf: Fix NULL pointer dereference in udf_symlink function (Pavel Reichl) [RHEL-37769] {CVE-2021-47353} - net: ti: fix UAF in tlan_remove_one (Jose Ignacio Tornos Martinez) [RHEL-38940] {CVE-2021-47310} - ARM: footbridge: fix PCI interrupt mapping (Myron Stowe) [RHEL-26971] {CVE-2021-46909} - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (Kamal Heib) [RHEL-37454] {CVE-2024-36004} - net/mlx5e: Fix mlx5e_priv_init() cleanup flow (Kamal Heib) [RHEL-37424] {CVE-2024-35959} - net/mlx5: Properly link new fs rules into the tree (Kamal Heib) [RHEL-37420] {CVE-2024-35960} - net/mlx5e: fix a potential double-free in fs_any_create_groups (Kamal Heib) [RHEL-37091] {CVE-2023-52667} - net: ena: Fix incorrect descriptor free behavior (Kamal Heib) [RHEL-37428] {CVE-2024-35958} - mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - mISDN: fix possible use-after-free in HFC_cleanup() (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - implement dh fallback for primes > 4K (Vladis Dronov) [RHEL-35106] - crypto: qat - avoid division by zero (Vladis Dronov) [RHEL-35106] - crypto: qat - resolve race condition during AER recovery (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - use kcalloc_node() instead of kzalloc_node() (Vladis Dronov) [RHEL-35106] - [rt] Enable CONFIG_DRM_MGAG200_DISABLE_WRITECOMBINE (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Add an option to disable Write-Combine (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Fix caching setup for remapped video memory (Jocelyn Falempe) [RHEL-36172] - Revert "drm/mgag200: Add a workaround for low-latency" (Jocelyn Falempe) [RHEL-36172] - mptcp: fix data re-injection from stale subflow (Davide Caratti) [RHEL-33133] {CVE-2024-26826} - ipv6: sr: fix incorrect unregister order (Hangbin Liu) [RHEL-31730] - ipv6: sr: fix possible use-after-free and null-ptr-deref (Hangbin Liu) [RHEL-31730] {CVE-2024-26735} - net/bnx2x: Prevent access to a freed page in page_pool (Michal Schmidt) [RHEL-14195 RHEL-33243] {CVE-2024-26859} - bnx2x: new flag for track HW resource allocation (Michal Schmidt) [RHEL-14195 RHEL-33243] - bnx2x: fix page fault following EEH recovery (Michal Schmidt) [RHEL-14195 RHEL-33243] - x86: KVM: SVM: always update the x2avic msr interception (Maxim Levitsky) [RHEL-15495] {CVE-2023-5090} - EDAC/thunderx: Fix possible out-of-bounds string access (Aristeu Rozanski) [RHEL-26573] {CVE-2023-52464} - [rt] build kernel-rt-4.18.0-553.7.1.rt7.348.el8_10 [RHEL-34640] - net: qcom/emac: fix UAF in emac_remove (Ken Cox) [RHEL-37834] {CVE-2021-47311} - perf/core: Bail out early if the request AUX area is out of bound (Michael Petlan) [RHEL-38268] {CVE-2023-52835} - crypto: pcrypt - Fix hungtask for PADATA_RESET (Herbert Xu) [RHEL-38171] {CVE-2023-52813} - drm/amdgpu: fix use-after-free bug (Jocelyn Falempe) [RHEL-31240] {CVE-2024-26656} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash (Ivan Vecera) [RHEL-37008] {CVE-2024-35854} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update (Ivan Vecera) [RHEL-37004] {CVE-2024-35855} - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (Ivan Vecera) [RHEL-37012] {CVE-2024-35853} - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work (Ivan Vecera) [RHEL-37016] {CVE-2024-35852} - mlxsw: spectrum_acl_tcam: Fix warning during rehash (Ivan Vecera) [RHEL-37480] {CVE-2024-36007} - can: peak_pci: peak_pci_remove(): fix UAF (Jose Ignacio Tornos Martinez) [RHEL-38419] {CVE-2021-47456} - usbnet: fix error return code in usbnet_probe() (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - usbnet: sanity check for maxpacket (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - net/mlx5e: fix a double-free in arfs_create_groups (Kamal Heib) [RHEL-36920] {CVE-2024-35835} - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds (Jose Ignacio Tornos Martinez) [RHEL-38220] {CVE-2023-52878} - net: cdc_eem: fix tx fixup skb leak (Jose Ignacio Tornos Martinez) [RHEL-38080] {CVE-2021-47236} - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Jose Ignacio Tornos Martinez) [RHEL-38113] {CVE-2023-52703} - usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() (Desnes Nunes) [RHEL-38248] {CVE-2023-52877} - usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (Desnes Nunes) [RHEL-38240] {CVE-2023-52781} - gro: fix ownership transfer (Xin Long) [RHEL-37226] {CVE-2024-35890} - tipc: fix kernel warning when sending SYN message (Xin Long) [RHEL-38109] {CVE-2023-52700} - erspan: make sure erspan_base_hdr is present in skb->head (Xin Long) [RHEL-37230] {CVE-2024-35888} - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() (Bryan Gurney) [RHEL-17366] - scsi: mpi3mr: Sanitise num_phys (Bryan Gurney) [RHEL-17366] - netfilter: nf_tables: use timestamp to check for set element timeout (Phil Sutter) [RHEL-38023] {CVE-2024-27397} - net/ipv6: SKB symmetric hash should incorporate transport ports (Sabrina Dubroca) [RHEL-32061] - crypto: s390/aes - Fix buffer overread in CTR mode (Herbert Xu) [RHEL-37089] {CVE-2023-52669} - net: Save and restore msg_namelen in sock_sendmsg (Jamie Bainbridge) [RHEL-35893] - net: prevent address rewrite in kernel_bind() (Jamie Bainbridge) [RHEL-35893] - net: prevent rewrite of msg_name in sock_sendmsg() (Jamie Bainbridge) [RHEL-35893] - net: replace calls to sock->ops->connect() with kernel_connect() (Jamie Bainbridge) [RHEL-35893] - net: Avoid address overwrite in kernel_connect (Jamie Bainbridge) [RHEL-35893] - wifi: iwlwifi: dbg-tlv: ensure NUL termination (Jose Ignacio Tornos Martinez) [RHEL-37026] {CVE-2024-35845} - wifi: mac80211: fix potential sta-link leak (Jose Ignacio Tornos Martinez) [RHEL-36916] {CVE-2024-35838} - wifi: nl80211: reject iftype change with mesh ID change (Jose Ignacio Tornos Martinez) [RHEL-36884] {CVE-2024-27410} - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (Jose Ignacio Tornos Martinez) [RHEL-36807] {CVE-2024-35789} - Bluetooth: Avoid potential use-after-free in hci_error_reset (David Marlin) [RHEL-31826] {CVE-2024-26801} - tls: disable async encrypt/decrypt (Sabrina Dubroca) [RHEL-26362 RHEL-26409 RHEL-26420] {CVE-2024-26585 CVE-2024-26583 CVE-2024-26584} - Squashfs: check the inode number is not the invalid value of zero (Phillip Lougher) [RHEL-35096] {CVE-2024-26982} - ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/msg.c: update and document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/sem.c: document and update memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: update/document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: remove duplicated code (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (Kamal Heib) [RHEL-30582] {CVE-2023-52626} - Revert "ACPI: bus: Rework system-level device notification handling" (Prarit Bhargava) [RHEL-21486] - hwrng: core - Fix page fault dead lock on mmap-ed hwrng (Prarit Bhargava) [RHEL-29485] {CVE-2023-52615} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - powerpc/pseries: pci - logic bug (Mamatha Inamdar) [RHEL-240146] - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228} - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899] {CVE-2026-90036} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680] {CVE-2026-72262} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641} - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781] {CVE-2026-74583} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916] {CVE-2026-68377} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271288] {CVE-2026-89631} - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280060] {CVE-2026-98320} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271853] {CVE-2026-93817} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191034] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191034] {CVE-2026-53196} - gfs2: a minor finish_xmote cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor run_queue fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: only apply DLM_LKF_VALBLK if sb_lvbptr is not NULL (Alexander Aring) [RHEL-129363] - gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Use wait_event_freezable_timeout() for freezable kthread (Andreas Gruenbacher) [RHEL-129363] - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-129363] - gfs2: low-memory forced flush fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: add missing withdraw locking (Andreas Gruenbacher) [RHEL-129363] - gfs2: Disable GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename "gfs_recovery" workqueue to "gfs2_recovery" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-129363] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-129363] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify do_promote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-129363] - gfs2: introduce new gfs2_glock_assert_withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify refcounting in do_xmote (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Make recovery error more readable (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark the remaining process-independent glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark flock glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of newlines in log messages (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-129363] - gfs2: Sanitize kthread stopping (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix logd wakeup on I/O error (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_quotad (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_logd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove duplicate check in do_xmote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove space before newline (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix LM_FLAG_TRY* logic in add_to_queue (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove DLM_LKF_ALTCW / DLM_LKF_ALTPR code (Andreas Gruenbacher) [RHEL-129363] - gfs2: Further sanitize lock_dlm.c (Andreas Gruenbacher) [RHEL-129363] - gfs2: sanitize the gdlm_ast -> finish_xmote interface (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify DLM_LKF_QUECVT use (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-129363] - gfs2: Lift withdraw check out of gfs2_ail1_empty (Andreas Gruenbacher) [RHEL-129363] - gfs2: don't withdraw if init_threads() got interrupted (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-129363] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix slab-use-after-free in gfs2_qd_dealloc (Andreas Gruenbacher) [RHEL-129363] {CVE-2023-52760} - gfs2: Fix asynchronous thread destruction (Andreas Gruenbacher) [RHEL-129363] - gfs2: Stop using gfs2_make_fs_ro for withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-129363] - gfs2: Turn gfs2_withdraw into a void function (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark withdraws as unlikely (Andreas Gruenbacher) [RHEL-129363] - gfs2: ignore rindex_update failure in dinode_dealloc (Andreas Gruenbacher) [RHEL-129363] - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270732] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256684] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256684] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256684] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271657] {CVE-2026-93288} - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254282] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-263292] {CVE-2026-89479} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254357] {CVE-2026-74588} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222954] {CVE-2026-52935} - powerpc/pseries: pci - logic bug (Mamatha Inamdar) [RHEL-240146] - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228} - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899] {CVE-2026-90036} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680] {CVE-2026-72262} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641} - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781] {CVE-2026-74583} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916] {CVE-2026-68377} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270905] {CVE-2026-89777} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263644] {CVE-2026-68202} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254200] {CVE-2026-80590} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233134] {CVE-2026-64572} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225459] {CVE-2026-64114} - xfs: bounds-check buffer log item's dirty bitmap (CKI Backport Bot) [RHEL-253365] {CVE-2026-80536} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234242] {CVE-2026-64266} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271288] {CVE-2026-89631} - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280060] {CVE-2026-98320} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271853] {CVE-2026-93817} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191034] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191034] {CVE-2026-53196} - gfs2: a minor finish_xmote cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor run_queue fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: only apply DLM_LKF_VALBLK if sb_lvbptr is not NULL (Alexander Aring) [RHEL-129363] - gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Use wait_event_freezable_timeout() for freezable kthread (Andreas Gruenbacher) [RHEL-129363] - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-129363] - gfs2: low-memory forced flush fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: add missing withdraw locking (Andreas Gruenbacher) [RHEL-129363] - gfs2: Disable GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename "gfs_recovery" workqueue to "gfs2_recovery" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-129363] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-129363] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify do_promote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-129363] - gfs2: introduce new gfs2_glock_assert_withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify refcounting in do_xmote (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Make recovery error more readable (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark the remaining process-independent glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark flock glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of newlines in log messages (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-129363] - gfs2: Sanitize kthread stopping (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix logd wakeup on I/O error (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_quotad (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_logd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove duplicate check in do_xmote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove space before newline (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix LM_FLAG_TRY* logic in add_to_queue (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove DLM_LKF_ALTCW / DLM_LKF_ALTPR code (Andreas Gruenbacher) [RHEL-129363] - gfs2: Further sanitize lock_dlm.c (Andreas Gruenbacher) [RHEL-129363] - gfs2: sanitize the gdlm_ast -> finish_xmote interface (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify DLM_LKF_QUECVT use (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-129363] - gfs2: Lift withdraw check out of gfs2_ail1_empty (Andreas Gruenbacher) [RHEL-129363] - gfs2: don't withdraw if init_threads() got interrupted (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-129363] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix slab-use-after-free in gfs2_qd_dealloc (Andreas Gruenbacher) [RHEL-129363] {CVE-2023-52760} - gfs2: Fix asynchronous thread destruction (Andreas Gruenbacher) [RHEL-129363] - gfs2: Stop using gfs2_make_fs_ro for withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-129363] - gfs2: Turn gfs2_withdraw into a void function (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark withdraws as unlikely (Andreas Gruenbacher) [RHEL-129363] - gfs2: ignore rindex_update failure in dinode_dealloc (Andreas Gruenbacher) [RHEL-129363] - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270732] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256684] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256684] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256684] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271657] {CVE-2026-93288} - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254282] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-263292] {CVE-2026-89479} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254357] {CVE-2026-74588} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222954] {CVE-2026-52935} - powerpc/pseries: pci - logic bug (Mamatha Inamdar) [RHEL-240146] - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228} - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899] {CVE-2026-90036} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680] {CVE-2026-72262} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641} - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781] {CVE-2026-74583} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916] {CVE-2026-68377} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - [rt] build kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 [RHEL-53529] - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071} - [rt] build kernel-rt-4.18.0-553.21.1.rt7.362.el8_10 [RHEL-53529] - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874] - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558} - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441} - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904} - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322} - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246} - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008} - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228} - [rt] build kernel-rt-4.18.0-553.20.1.rt7.361.el8_10 [RHEL-53529] - KVM: arm64: Disassociate vcpus from redistributor region on teardown (Shaoqin Huang) [RHEL-48417] {CVE-2024-40989} - devres: Fix memory leakage caused by driver API devm_free_percpu() (CKI Backport Bot) [RHEL-55597] {CVE-2024-43871} - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (Izabela Bakollari) [RHEL-26680] {CVE-2024-26600} - nvmet-fc: avoid deadlock on delete association path (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - nvmet-fc: release reference on target port (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - ACPI: LPIT: Avoid u32 multiplication overflow (Mark Langsdorf) [RHEL-37062] {CVE-2023-52683} - sched/deadline: Fix task_struct reference leak (Phil Auld) [RHEL-50904] {CVE-2024-41023} - nfsd: fix crash on LOCKT on reexported NFSv3 (Benjamin Coddington) [RHEL-31515] - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path (CKI Backport Bot) [RHEL-26570] {CVE-2024-26595} - mlxsw: spectrum_acl_tcam: Move devlink param to TCAM code (Ivan Vecera) [RHEL-26570] {CVE-2024-26595} - ACPI: extlog: fix NULL pointer dereference check (Mark Langsdorf) [RHEL-29110] {CVE-2023-52605} - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() (Mark Langsdorf) [RHEL-33198] {CVE-2024-26894} - mm: prevent derefencing NULL ptr in pfn_section_valid() (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - mm, kmsan: fix infinite recursion due to RCU critical section (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - cipso: make cipso_v4_skbuff_delattr() fully remove the CIPSO options (Ondrej Mosnacek) [RHEL-30904] - cipso: fix total option length computation (Ondrej Mosnacek) [RHEL-30904] - ext4: do not create EA inode under buffer lock (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: check the return value of ext4_xattr_inode_dec_ref() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (Carlos Maiolino) [RHEL-48507] {CVE-2024-40998} - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - [rt] build kernel-rt-4.18.0-553.19.1.rt7.360.el8_10 [RHEL-53529] - drm/i915/vma: Fix UAF on destroy against retire race (Mika Penttilä) [RHEL-35222] {CVE-2024-26939} - RHEL-48620 (Kenneth Yin) [RHEL-48620] - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (CKI Backport Bot) [RHEL-42721] {CVE-2024-26855} - net: usb: asix: do not force pause frames support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix "can't send until first packet is send" issue (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix modprobe "sysfs: cannot create duplicate filename" (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: add proper error handling of usb read errors (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix wrong return value in asix_check_host_enable() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix uninit-value in asix_mdio_read() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: fix boolconv.cocci warnings (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: do not call phy_disconnect() for ax88178 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: move embedded PHY detection as early as possible (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix uninit value bugs (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add missing stop (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: suspend PHY on driver probe (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: manage PHY PM from MAC (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: add error handling for asix_mdio_* functions (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add phylib support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: refactor asix_read_phy_addr() and handle errors on return (Ken Cox) [RHEL-28108] {CVE-2021-47101} - SUNRPC: always free ctxt when freeing deferred request (Jay Shin) [RHEL-40936] - SUNRPC: double free xprt_ctxt while still in use (Jay Shin) [RHEL-40936] - SUNRPC: Remove svc_rqst::rq_xprt_hlen (Jay Shin) [RHEL-40936] - SUNRPC: Remove dead code in svc_tcp_release_rqst() (Jay Shin) [RHEL-40936] - x86/bugs: Extend VMware Retbleed workaround to Nehalem & earlier CPUs (Waiman Long) [RHEL-48646] - wifi: iwlwifi: read txq->read_ptr under lock (Jose Ignacio Tornos Martinez) [RHEL-39797] {CVE-2024-36922} - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (John Meneghini) [RHEL-39908] {CVE-2024-36919} - nbd: always initialize struct msghdr completely (Ming Lei) [RHEL-29498] {CVE-2024-26638} - block: don't call rq_qos_ops->done_bio if the bio isn't tracked (Ming Lei) [RHEL-42151] {CVE-2021-47412} - nvmet: fix a possible leak when destroy a ctrl during qp establishment (Maurizio Lombardi) [RHEL-52013] {CVE-2024-42152} - ipv6: prevent NULL dereference in ip6_output() (Sabrina Dubroca) [RHEL-39912] {CVE-2024-36901} - ppp: reject claimed-as-LCP but actually malformed packets (Guillaume Nault) [RHEL-51052] {CVE-2024-41044} - leds: trigger: Unregister sysfs attributes before calling deactivate() (CKI Backport Bot) [RHEL-54834] {CVE-2024-43830} - crypto: bcm - Fix pointer arithmetic (cki-backport-bot) [RHEL-44108] {CVE-2024-38579} - scsi: qedf: Ensure the copied buf is NUL terminated (John Meneghini) [RHEL-44195] {CVE-2024-38559} - x86/bhi: Avoid warning in #DB handler due to BHI mitigation (Waiman Long) [RHEL-53657] {CVE-2024-42240} - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (CKI Backport Bot) [RHEL-47529] {CVE-2024-40901} - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (CKI Backport Bot) [RHEL-39843] {CVE-2024-36902} - net: usb: ax88179_178a: improve link status logs (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: improve reset check (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: fix link status when link is set to down/up (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: avoid writing the mac address before first reading (Jose Ignacio Tornos Martinez) [RHEL-45167] - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - media: cec: cec-api: add locking in cec_release() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid confusing "transmit timed out" message (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid recursive cec_claim_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: remove length check of Timer Status (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: count low-drive, error and arb-lost conditions (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add note about *_from_edid() function usage in drm (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_unconfigured() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_nb_transmit_canceled() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: don't set last_initiator if tx in progress (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: disable adapter in cec_devnode_unregister (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: not all messages were passed on when monitoring (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add support for Absolute Volume Control (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: log when claiming LA fails unexpectedly (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: drop activate_cnt, use state info instead (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: reconfigure if the PA changes during configuration (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: fix is_configuring state (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: stop trying LAs on CEC_TX_STATUS_TIMEOUT (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't unconfigure if already unconfigured (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add optional adap_configured callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add xfer_timeout_ms field (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: use call_op and check for !unregistered (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix interrupt en/disable handling (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: drop unused 'enabled' field from struct cec_pin (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix off-by-one SFT check (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: rename timer overrun variables (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: correctly pass on reply results (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: abort if the current transmit was canceled (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: call enable_adap on s_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: media/cec.h: document cec_adapter fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix a deadlock situation (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: safely unhook lists in cec_data (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: copy sequence field for the reply (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix trivial style warnings (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: add 'unregistered' checks (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't use flush_scheduled_work() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: Use fallthrough pseudo-keyword (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: remove unused waitq and phys_addrs fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: silence shift wrapping warning in __cec_s_log_addrs() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: move the core to a separate directory (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - net/iucv: Avoid explicit cpumask var allocation on stack (CKI Backport Bot) [RHEL-51631] {CVE-2024-42094} - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (Dick Kennedy) [RHEL-40400] - KVM: selftests: Make hyperv_clock require TSC based system clocksource (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Run clocksource dependent tests with hyperv_clocksource_tsc_page too (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Use generic sys_clocksource_is_tsc() in vmx_nested_tsc_scaling_test (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Generalize check_clocksource() from kvm_clock_test (Vitaly Kuznetsov) [RHEL-19027] - firmware: cs_dsp: Return error if block header overflows file (CKI Backport Bot) [RHEL-53646] {CVE-2024-42238} - firmware: cs_dsp: Validate payload length before processing block (CKI Backport Bot) [RHEL-53638] {CVE-2024-42237} - mm, slub: fix potential memoryleak in kmem_cache_open() (Waiman Long) [RHEL-38404] {CVE-2021-47466} - slub: don't panic for memcg kmem cache creation failure (Waiman Long) [RHEL-38404] {CVE-2021-47466} - wifi: ath11k: fix htt pktlog locking (Jose Ignacio Tornos Martinez) [RHEL-38317] {CVE-2023-52800} - wifi: ath11k: fix dfs radar event locking (Jose Ignacio Tornos Martinez) [RHEL-38165] {CVE-2023-52798} - lib/generic-radix-tree.c: Don't overflow in peek() (Waiman Long) [RHEL-37737] {CVE-2021-47432} - include/linux/generic-radix-tree.h: replace kernel.h with the necessary inclusions (Waiman Long) [RHEL-37737] {CVE-2021-47432} - EDAC/i10nm: Skip the absent memory controllers (Aristeu Rozanski) [RHEL-43236] - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (John Meneghini) [RHEL-38197] {CVE-2023-52809} - gfs2: Fix potential glock use-after-free on unmount (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: simplify gdlm_put_lock with out_free label (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: Remove ill-placed consistency check (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - nvme-fc: do not wait in vain when unloading module (Ewan D. Milne) [RHEL-33083] {CVE-2024-26846} - HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts (CKI Backport Bot) [RHEL-49698] {CVE-2022-48866} - scsi: qedf: Set qed_slowpath_params to zero before use (John Meneghini) [RHEL-9797] - scsi: qedf: Wait for stag work during unload (John Meneghini) [RHEL-9797] - scsi: qedf: Don't process stag work during unload and recovery (John Meneghini) [RHEL-9797] - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - mm: avoid overflows in dirty throttling logic (Audra Mitchell) [RHEL-51840] {CVE-2024-42131} - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - ACPI: fix NULL pointer dereference (Mark Langsdorf) [RHEL-37897] {CVE-2021-47289} - [rt] build kernel-rt-4.18.0-553.18.1.rt7.359.el8_10 [RHEL-53529] - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING (Ewan D. Milne) [RHEL-39805] {CVE-2024-36920} - tun: limit printing rate when illegal packet received by tun dev (Jon Maloy) [RHEL-35046] {CVE-2024-27013} - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu/mes: fix use-after-free issue (Michel Dänzer) [RHEL-44043] {CVE-2024-38581} - drm/amdgpu: Fix the null pointer when load rlc firmware (Michel Dänzer) [RHEL-30603] {CVE-2024-26649} - drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (Michel Dänzer) [RHEL-35160] {CVE-2024-27042} - net/sched: Fix UAF when resolving a clash (Xin Long) [RHEL-51014] {CVE-2024-41040} - tcp_metrics: validate source addr length (Guillaume Nault) [RHEL-52025] {CVE-2024-42154} - NFSv4/pnfs: Fix a use-after-free bug in open (Benjamin Coddington) [RHEL-35508] - NFSv4: Don't hold the layoutget locks across multiple RPC calls (Benjamin Coddington) [RHEL-35508] - scsi: qedf: Make qedf_execute_tmf() non-preemptible (John Meneghini) [RHEL-51799] {CVE-2024-42124} - Input: elantech - fix stack out of bound access in elantech_change_report_id() (CKI Backport Bot) [RHEL-41938] {CVE-2021-47097} - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (CKI Backport Bot) [RHEL-28982] {CVE-2023-52478} - drm/radeon: fix UBSAN warning in kv_dpm.c (CKI Backport Bot) [RHEL-48399] {CVE-2024-40988} - usb: core: Don't hold the device lock while sleeping in do_proc_control() (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - USB: core: Make do_proc_control() and do_proc_bulk() killable (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - scsi: qedi: Fix crash while reading debugfs attribute (CKI Backport Bot) [RHEL-48327] {CVE-2024-40978} - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CKI Backport Bot) [RHEL-48309] {CVE-2024-40977} - net: tcp: accept old ack during closing (Jamie Bainbridge) [RHEL-52433] - wifi: iwlwifi: mvm: don't read past the mfuart notifcation (CKI Backport Bot) [RHEL-48016] {CVE-2024-40941} - net/iucv: fix use after free in iucv_sock_close() (Mete Durlu) [RHEL-53988] - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (CKI Backport Bot) [RHEL-47908] {CVE-2024-40929} - Input: aiptek - properly check endpoint type (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - use descriptors of current altsetting (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - fix endpoint sanity check (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB (CKI Backport Bot) [RHEL-52373] {CVE-2024-42226} - wifi: mt76: replace skb_put with skb_put_zero (CKI Backport Bot) [RHEL-52366] {CVE-2024-42225} - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (CKI Backport Bot) [RHEL-47776] {CVE-2024-40912} - wifi: cfg80211: Lock wiphy in cfg80211_get_station (CKI Backport Bot) [RHEL-47758] {CVE-2024-40911} - VMCI: Use struct_size() in kmalloc() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() (Steve Best) [RHEL-37325] {CVE-2024-35944} - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values (Jose Ignacio Tornos Martinez) [RHEL-51761] {CVE-2024-42114} - usb: atm: cxacru: fix endpoint checking in cxacru_bind() (CKI Backport Bot) [RHEL-51442] {CVE-2024-41097} - nfs: handle error of rpc_proc_register() in init_nfs_fs() (Scott Mayhew) [RHEL-39904] {CVE-2024-36939} - drm/radeon: check bo_va->bo is non-NULL before using it (CKI Backport Bot) [RHEL-51184] {CVE-2024-41060} - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). (CKI Backport Bot) [RHEL-51027] {CVE-2024-41041} - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (CKI Backport Bot) [RHEL-50961] {CVE-2024-41035} - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). (CKI Backport Bot) [RHEL-44408] {CVE-2024-37356} - tcp: avoid too many retransmit packets (Florian Westphal) [RHEL-48627] {CVE-2024-41007} - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() (Florian Westphal) [RHEL-48627] - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Florian Westphal) [RHEL-48627] - tcp: refactor tcp_retransmit_timer() (Florian Westphal) [RHEL-48627] - tcp: exit if nothing to retransmit on RTO timeout (Florian Westphal) [RHEL-48627] - netfilter: nf_tables: Reject tables of unsupported family (Florian Westphal) [RHEL-21418] {CVE-2023-6040} - [rt] build kernel-rt-4.18.0-553.17.1.rt7.358.el8_10 [RHEL-53529] - kyber: fix out of bounds access when preempted (Ming Lei) [RHEL-27258] {CVE-2021-46984} - vfs: don't mod negative dentry count when on shrinker list (Brian Foster) [RHEL-35874] - fs/dcache: Re-use value stored to dentry->d_flags instead of re-reading (Brian Foster) [RHEL-35874] - fbmem: Do not delete the mode that is still in use (CKI Backport Bot) [RHEL-37796] {CVE-2021-47338} - netpoll: Fix race condition in netpoll_owner_active (CKI Backport Bot) [RHEL-49361] {CVE-2024-41005} - firmware: arm_scpi: Fix string overflow in SCPI genpd driver (Mark Salter) [RHEL-43702] {CVE-2021-47609} - ipv6: prevent possible NULL dereference in rt6_probe() (Guillaume Nault) [RHEL-48149] {CVE-2024-40960} - HID: i2c-hid-of: fix NULL-deref on failed power up (CKI Backport Bot) [RHEL-31598] {CVE-2024-26717} - cpufreq: amd-pstate: fix memory leak on CPU EPP exit (CKI Backport Bot) [RHEL-48489] {CVE-2024-40997} - x86/mm/pat: fix VM_PAT handling in COW mappings (Chris von Recklinghausen) [RHEL-37258] {CVE-2024-35877} - PCI/PM: Drain runtime-idle callbacks before driver removal (Myron Stowe) [RHEL-42937] {CVE-2024-35809} - PCI: Drop pci_device_remove() test of pci_dev->driver (Myron Stowe) [RHEL-42937] {CVE-2024-35809} - drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() (Mika Penttilä) [RHEL-26909] {CVE-2023-52470} - USB: core: Fix hang in usb_kill_urb by adding memory barriers (Desnes Nunes) [RHEL-43979] {CVE-2022-48760} - cifs: fix bad fids sent over wire (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB311_posix_mkdir (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB2_tcon (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB2_open (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB2_ioctl (Paulo Alcantara) [RHEL-52517] - selftests: forwarding: devlink_lib: Wait for udev events after reloading (Mark Langsdorf) [RHEL-47642] {CVE-2024-39501} - drivers: core: synchronize really_probe() and dev_uevent() (Mark Langsdorf) [RHEL-47642] {CVE-2024-39501} - udp: do not accept non-tunnel GSO skbs landing in a tunnel (Xin Long) [RHEL-42997] {CVE-2024-35884} - filelock: Remove locks reliably when fcntl/close race is detected (Bill O'Donnell) [RHEL-50170] {CVE-2024-41012} - Input: add bounds checking to input_set_capability() (Benjamin Tissoires) [RHEL-21413] {CVE-2022-48619} - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() (CKI Backport Bot) [RHEL-48130] {CVE-2024-40959} - blk-cgroup: fix list corruption from reorder of WRITE ->lqueued (Ming Lei) [RHEL-33695] - blk-cgroup: fix list corruption from resetting io stat (Ming Lei) [RHEL-33695] - net: do not leave a dangling sk pointer, when socket creation fails (CKI Backport Bot) [RHEL-48060] {CVE-2024-40954} - perf/x86/lbr: Filter vsyscall addresses (Michael Petlan) [RHEL-28991] {CVE-2023-52476} - vmci: prevent speculation leaks by sanitizing event in event_deliver() (CKI Backport Bot) [RHEL-47678] {CVE-2024-39499} - serial: core: fix transmit-buffer reset and memleak (Steve Best) [RHEL-38731] {CVE-2021-47527} - powerpc/pseries: Whitelist dtl slub object for copying to userspace (Mamatha Inamdar) [RHEL-51236] {CVE-2024-41065} - powerpc/eeh: avoid possible crash when edev->pdev changes (Mamatha Inamdar) [RHEL-51220] {CVE-2024-41064} - x86: stop playing stack games in profile_pc() (Steve Best) [RHEL-51643] {CVE-2024-42096} - mptcp: ensure snd_una is properly initialized on connect (Florian Westphal) [RHEL-47933 RHEL-47934] {CVE-2024-40931} - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet (CKI Backport Bot) [RHEL-47492] {CVE-2024-39506} - tun: add missing verification for short frame (Patrick Talbert) [RHEL-50194] {CVE-2024-41091} - tap: add missing verification for short frame (Patrick Talbert) [RHEL-50279] {CVE-2024-41090} - usb-storage: alauda: Check whether the media is initialized (Desnes Nunes) [RHEL-43708] {CVE-2024-38619} - usb-storage: alauda: Fix uninit-value in alauda_check_media() (Desnes Nunes) [RHEL-43708] {CVE-2024-38619} - hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37723] {CVE-2021-47384} - block: fix that util can be greater than 100% (Ming Lei) [RHEL-23074] - block: support to account io_ticks precisely (Ming Lei) [RHEL-23074] - watchdog: Fix possible use-after-free by calling del_timer_sync() (Steve Best) [RHEL-38795] {CVE-2021-47321} - hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37719] {CVE-2021-47385} - mlxsw: spectrum: Protect driver from buggy firmware (CKI Backport Bot) [RHEL-42245] {CVE-2021-47560} - mlxsw: Verify the accessed index doesn't exceed the array length (CKI Backport Bot) [RHEL-42245] {CVE-2021-47560} - dm: call the resume method on internal suspend (Benjamin Marzinski) [RHEL-41835] {CVE-2024-26880} - tty: Fix out-of-bound vmalloc access in imageblit (Steve Best) [RHEL-37727] {CVE-2021-47383} - hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37715] {CVE-2021-47386} - hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs (Steve Best) [RHEL-37710] {CVE-2021-47393} - nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells (Steve Best) [RHEL-38436] {CVE-2021-47497} - driver core: auxiliary bus: Fix memory leak when driver_register() fail (Steve Best) [RHEL-37901] {CVE-2021-47287} - phylib: fix potential use-after-free (cki-backport-bot) [RHEL-43764] {CVE-2022-48754} - ptp: Fix possible memory leak in ptp_clock_register() (Hangbin Liu) [RHEL-38424] {CVE-2021-47455} - NFSv4: Fix memory leak in nfs4_set_security_label (CKI Backport Bot) [RHEL-51315] {CVE-2024-41076} - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER (CKI Backport Bot) [RHEL-51618] {CVE-2024-42090} - ftruncate: pass a signed offset (CKI Backport Bot) [RHEL-51598] {CVE-2024-42084} - af_unix: Fix garbage collector racing against connect() (Felix Maurer) [RHEL-34225] {CVE-2024-26923} - virtio-net: Add validation for used length (Laurent Vivier) [RHEL-42080] {CVE-2021-47352} - net: fix possible store tearing in neigh_periodic_work() (Antoine Tenart) [RHEL-42359] {CVE-2023-52522} - tunnels: fix out of bounds access when building IPv6 PMTU error (Antoine Tenart) [RHEL-41823] {CVE-2024-26665} - vt_ioctl: fix array_index_nospec in vt_setactivate (John W. Linville) [RHEL-49141] {CVE-2022-48804} - Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() (CKI Backport Bot) [RHEL-38302] {CVE-2023-52840} - netns: Make get_net_ns() handle zero refcount net (Antoine Tenart) [RHEL-48105] {CVE-2024-40958} - tracing: Ensure visibility when inserting an element into tracing_map (Michael Petlan) [RHEL-30457] {CVE-2024-26645} - KVM: s390: fix LPSWEY handling (CKI Backport Bot) [RHEL-50072] - firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files (CKI Backport Bot) [RHEL-51144] {CVE-2024-41056} - SUNRPC: Fix a race to wake a sync task (Benjamin Coddington) [RHEL-11843] - firmware: cs_dsp: Fix overflow checking of wmfw header (CKI Backport Bot) [RHEL-50999] {CVE-2024-41039} - firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers (CKI Backport Bot) [RHEL-50987] {CVE-2024-41038} - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (Xin Long) [RHEL-48471] {CVE-2024-40995} - net: fix out-of-bounds access in ops_init (Xin Long) [RHEL-43185] {CVE-2024-36883} - x86/mce/therm_throt: Undo thermal polling properly on CPU offline (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Do not access uninitialized therm_work (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Mark throttle_active_work() as __maybe_unused (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Mask out read-only and reserved MSR bits (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Optimize notifications of thermal throttle (Steve Best) [RHEL-45310] - jiffies: add utility function to calculate delta in ms (Steve Best) [RHEL-45310] - x86/mce: Lower throttling MCE messages' priority to warning (Steve Best) [RHEL-45310] - dmaengine: idxd: Fix oops during rmmod on single-CPU platforms (Eder Zulian) [RHEL-37361] {CVE-2024-35989} - xfs: don't walk off the end of a directory data block (CKI Backport Bot) [RHEL-50879] {CVE-2024-41013} - xfs: add bounds checking to xlog_recover_process_data (CKI Backport Bot) [RHEL-50856] {CVE-2024-41014} - dm-crypt: limit the size of encryption requests (Benjamin Marzinski) [RHEL-29330] - netfilter: flowtable: remove nf_ct_l4proto_find() call (Florian Westphal) [RHEL-49589] - [rt] build kernel-rt-4.18.0-553.16.1.rt7.357.el8_10 [RHEL-44553] - x86/bhi: Fix incorrect CLEAR_BRANCH_HISTORY position in entry_INT80_compat (Waiman Long) [RHEL-50648] - [rt] build kernel-rt-4.18.0-553.15.1.rt7.356.el8_10 [RHEL-44553] - Revert "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-44613] - ionic: fix use after netif_napi_del() (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - ionic: clean interrupt before enabling queue to avoid credit race (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change (CKI Backport Bot) [RHEL-49321] {CVE-2021-47624} - xhci: Handle TD clearing for multiple streams case (CKI Backport Bot) [RHEL-47882] {CVE-2024-40927} - net: openvswitch: Fix Use-After-Free in ovs_ct_exit (cki-backport-bot) [RHEL-36362] {CVE-2024-27395} - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: fix vlan use-after-free (cki-backport-bot) [RHEL-43721] {CVE-2024-36979} - irqchip/gic-v3-its: Prevent double free on error (Charles Mirabile) [RHEL-37022] {CVE-2024-35847} - irqchip/gic-v3-its: Fix potential VPE leak on error (Charles Mirabile) [RHEL-37744] {CVE-2021-47373} - i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() (Charles Mirabile) [RHEL-34735] {CVE-2022-48632} - iommu/dma: fix zeroing of bounce buffer padding used by untrusted devices (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: remove alloc_size argument to swiotlb_tbl_map_single() (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: fix swiotlb_bounce() to do partial sync's correctly (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Reinstate page-alignment for mappings >= PAGE_SIZE (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix alignment checks when both allocation and DMA masks are present (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix double-allocation of slots due to broken alignment handling (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (cki-backport-bot) [RHEL-44441] {CVE-2024-31076} - [rt] build kernel-rt-4.18.0-553.14.1.rt7.355.el8_10 [RHEL-44553] - s390/qeth: Fix kernel panic after setting hsuid (Mete Durlu) [RHEL-49754] - perf/core: Protect event sibling list locking against interrupt inversion (Daniel Vacek) [RHEL-31798] - vt: fix unicode buffer corruption when deleting characters (Steve Best) [RHEL-36936] {CVE-2024-35823} - cifs: translate network errors on send to -ECONNABORTED (Paulo Alcantara) [RHEL-36754] - xfs: don't block in busy flushing when freeing extents (Brian Foster) [RHEL-7984] - xfs: allow extent free intents to be retried (Brian Foster) [RHEL-7984] - xfs: pass alloc flags through to xfs_extent_busy_flush() (Brian Foster) [RHEL-7984] - xfs: use deferred frees for btree block freeing (Brian Foster) [RHEL-7984] - xfs: fix bounds check in xfs_defer_agfl_block() (Brian Foster) [RHEL-7984] - xfs: validate block number being freed before adding to xefi (Brian Foster) [RHEL-7984] - xfs: rename xfs_bmap_add_free to xfs_free_extent_later (Brian Foster) [RHEL-7984] - usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (Desnes Nunes) [RHEL-36803] {CVE-2024-35790} - stm class: Fix a double free in stm_register_device() (Steve Best) [RHEL-44514] {CVE-2024-38627} - s390/qeth: Fix potential loss of L3-IP@ in case of network issues (Mete Durlu) [RHEL-49755] - tls: fix missing memory barrier in tls_init (cki-backport-bot) [RHEL-44471] {CVE-2024-36489} - xfs: fix log recovery buffer allocation for the legacy h_size fixup (Bill O'Donnell) [RHEL-46473] {CVE-2024-39472} - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: use __for_each_thread() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - exit: Use the correct exit_code in /proc/<pid>/stat (Brian Foster) [RHEL-31562] {CVE-2024-26686} - scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool (Ewan D. Milne) [RHEL-38283] {CVE-2023-52811} - scsi: qla2xxx: Fix double free of fcport (Ewan D. Milne) [RHEL-39549] {CVE-2024-26929} - scsi: qla2xxx: Fix double free of the ha->vp_map pointer (Ewan D. Milne) [RHEL-39549] {CVE-2024-26930} - scsi: qla2xxx: Fix command flush on cable pull (Ewan D. Milne) [RHEL-39549] {CVE-2024-26931} - [rt] build kernel-rt-4.18.0-553.13.1.rt7.354.el8_10 [RHEL-44553] - redhat: remove handling of deleted rhdocs/ directory from genspec.sh (Denys Vlasenko) - x86/bugs: Fix BHI retpoline check (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI handling of RRSBA (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr' (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI documentation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix return type of spectre_bhi_state() (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Make CONFIG_SPECTRE_BHI_ON the default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Mitigate KVM by default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add BHI mitigation knob (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Enumerate Branch History Injection (BHI) bug (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Define SPEC_CTRL_BHI_DIS_S (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add support for clearing branch history at syscall entry (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file (Waiman Long) [RHEL-28202] - perf/x86/amd/lbr: Use freeze based on availability (Waiman Long) [RHEL-28202] - Documentation/kernel-parameters: Add spec_rstack_overflow to mitigations=off (Waiman Long) [RHEL-28202] - KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace (Waiman Long) [RHEL-28202] - x86/bugs: Reset speculation control settings on init (Waiman Long) [RHEL-28202] - KVM: x86: Update KVM-only leaf handling to allow for 100% KVM-only leafs (Waiman Long) [RHEL-28202] - KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest (Waiman Long) [RHEL-28202] - mptcp: ensure snd_nxt is properly initialized on connect (Davide Caratti) [RHEL-39865] {CVE-2024-36889} - powerpc/pseries: Enforce hcall result buffer validity and size (Mamatha Inamdar) [RHEL-48291] {CVE-2024-40974} - wifi: mac80211: fix potential key use-after-free (Jose Ignacio Tornos Martinez) [RHEL-28007] {CVE-2023-52530} - cppc_cpufreq: Fix possible null pointer dereference (Mark Langsdorf) [RHEL-44137] {CVE-2024-38573} - net/sched: act_mirred: use the backlog for mirred ingress (Davide Caratti) [RHEL-31718] {CVE-2024-26740} - vfio/pci: Lock external INTx masking ops (Alex Williamson) [RHEL-31922] {CVE-2024-26810} - net: sched: sch_multiq: fix possible OOB write in multiq_tune() (Davide Caratti) [RHEL-43464] {CVE-2024-36978} - tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized (Guillaume Nault) [RHEL-37850] {CVE-2021-47304} - pstore/ram: Fix crash when setting number of cpus to an odd number (Lenny Szubowicz) [RHEL-29471] {CVE-2023-52619} - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node (Jocelyn Falempe) [RHEL-37101] {CVE-2023-52662} - drm/vmwgfx: Fix the lifetime of the bo cursor memory (Jocelyn Falempe) [RHEL-36962] {CVE-2024-35810} - drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed (Jocelyn Falempe) [RHEL-34987] {CVE-2024-26940} - drm/vmwgfx: Unmap the surface before resetting it on a plane state (Jocelyn Falempe) [RHEL-35217] {CVE-2023-52648} - drm/vmwgfx: Fix invalid reads in fence signaled events (Jocelyn Falempe) [RHEL-40010] {CVE-2024-36960} - block: Fix wrong offset in bio_truncate() (Ming Lei) [RHEL-43782] {CVE-2022-48747} - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CKI Backport Bot) [RHEL-46913] {CVE-2024-39487} - net: fix __dst_negative_advice() race (Xin Long) [RHEL-41183] {CVE-2024-36971} - igc: avoid returning frame twice in XDP_REDIRECT (Corinna Vinschen) [RHEL-33264] {CVE-2024-26853} - mac802154: fix llsec key resources release in mac802154_llsec_key_del (Steve Best) [RHEL-34967] {CVE-2024-26961} - cpufreq: exit() callback is optional (Mark Langsdorf) [RHEL-43840] {CVE-2024-38615} - cifs: prevent infinite recursion in CIFSGetDFSRefer() (Paulo Alcantara) [RHEL-34672] - cifs: lock chan_lock outside match_session (Paulo Alcantara) [RHEL-34672] - smb3: workaround negprot bug in some Samba servers (Paulo Alcantara) [RHEL-34672] - smb3: use netname when available on secondary channels (Paulo Alcantara) [RHEL-34672] - smb3: fix empty netname context on secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: populate empty hostnames for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: always iterate smb sessions using primary channel (Paulo Alcantara) [RHEL-34672] - cifs: Fix connections leak when tlink setup failed (Paulo Alcantara) [RHEL-34672] - cifs: Fix memory leak when build ntlmssp negotiate blob failed (Paulo Alcantara) [RHEL-34672] - cifs: always initialize struct msghdr smb_msg completely (Paulo Alcantara) [RHEL-34672] - cifs: don't send down the destination address to sendmsg for a SOCK_STREAM (Paulo Alcantara) [RHEL-34672] - cifs: revalidate mapping when doing direct writes (Paulo Alcantara) [RHEL-34672] - cifs: skip extra NULL byte in filenames (Paulo Alcantara) [RHEL-34672] - cifs: list_for_each() -> list_for_each_entry() (Paulo Alcantara) [RHEL-34672] - smb2: small refactor in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - cifs: Fix crash on unload of cifs_arc4.ko (Paulo Alcantara) [RHEL-34672] - cifs: remove check of list iterator against head past the loop body (Paulo Alcantara) [RHEL-34672] - cifs: fix reconnect on smb3 mount types (Paulo Alcantara) [RHEL-34672] - cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (Paulo Alcantara) [RHEL-34672] - cifs: skip trailing separators of prefix paths (Paulo Alcantara) [RHEL-34672] - cifs: fix ntlmssp on old servers (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL ptr dereference in refresh_mounts() (Paulo Alcantara) [RHEL-34672] - cifs: do not skip link targets when an I/O fails (Paulo Alcantara) [RHEL-34672] - cifs: fix confusing unneeded warning message on smb2.1 and earlier (Paulo Alcantara) [RHEL-34672] - smb3: fix snapshot mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix workstation_name for multiuser mounts (Paulo Alcantara) [RHEL-34672] - cifs: alloc_path_with_tree_prefix: do not append sep. if the path is empty (Paulo Alcantara) [RHEL-34672] - cifs: free ntlmsspblob allocated in negotiate (Paulo Alcantara) [RHEL-34672] - cifs: avoid use of dstaddr as key for fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: add server conn_id to fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: fix missed refcounting of ipc tcon (Paulo Alcantara) [RHEL-34672] - smb2: clarify rc initialization in smb2_reconnect (Paulo Alcantara) [RHEL-34672] - cifs: populate server_hostname for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should be set on new server (Paulo Alcantara) [RHEL-34672] - cifs: introduce cifs_ses_mark_for_reconnect() helper (Paulo Alcantara) [RHEL-34672] - cifs: protect srv_count with cifs_tcp_ses_lock (Paulo Alcantara) [RHEL-34672] - cifs: move debug print out of spinlock (Paulo Alcantara) [RHEL-34672] - cifs: do not duplicate fscache cookie for secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: connect individual channel servers to primary channel server (Paulo Alcantara) [RHEL-34672] - cifs: protect session channel fields with chan_lock (Paulo Alcantara) [RHEL-34672] - cifs: do not negotiate session if session already exists (Paulo Alcantara) [RHEL-34672] - smb3: do not setup the fscache_super_cookie until fsinfo initialized (Paulo Alcantara) [RHEL-34672] - cifs: fix potential use-after-free bugs (Paulo Alcantara) [RHEL-34672] - cifs: release lock earlier in dequeue_mid error case (Paulo Alcantara) [RHEL-34672] - smb3: remove trivial dfs compile warning (Paulo Alcantara) [RHEL-34672] - cifs: support nested dfs links over reconnect (Paulo Alcantara) [RHEL-34672] - cifs: for compound requests, use open handle if possible (Paulo Alcantara) [RHEL-34672] - cifs: split out dfs code from cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant (Paulo Alcantara) [RHEL-34672] - cifs: introduce new helper for cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: fix print of hdr_flags in dfscache_proc_show() (Paulo Alcantara) [RHEL-34672] - cifs: send workstation name during ntlmssp session setup (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should not share socket with future sessions (Paulo Alcantara) [RHEL-34672] - smb3: add dynamic trace points for socket connection (Paulo Alcantara) [RHEL-34672] - cifs: Move SMB2_Create definitions to the shared area (Paulo Alcantara) [RHEL-34672] - cifs: Move more definitions into the shared area (Paulo Alcantara) [RHEL-34672] - cifs: move NEGOTIATE_PROTOCOL definitions out into the common area (Paulo Alcantara) [RHEL-34672] - cifs: Create a new shared file holding smb2 pdu definitions (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect check for null pointer in header_assemble (Paulo Alcantara) [RHEL-34672] - smb3: correct server pointer dereferencing check to be more consistent (Paulo Alcantara) [RHEL-34672] - cifs: Deal with some warnings from W=1 (Paulo Alcantara) [RHEL-34672] - cifs: fix a sign extension bug (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect kernel doc comments (Paulo Alcantara) [RHEL-34672] - cifs: remove pathname for file from SPDX header (Paulo Alcantara) [RHEL-34672] - cifs: move SMB FSCTL definitions to common code (Paulo Alcantara) [RHEL-34672] - cifs: rename cifs_common to smbfs_common (Paulo Alcantara) [RHEL-34672] - cifs: update FSCTL definitions (Paulo Alcantara) [RHEL-34672] - cifs: cifs_md4 convert to SPDX identifier (Paulo Alcantara) [RHEL-34672] - cifs: create a MD4 module and switch cifs.ko to use it (Paulo Alcantara) [RHEL-34672] - cifs: fork arc4 and create a separate module for it for cifs and other users (Paulo Alcantara) [RHEL-34672] - smb3: fix posix extensions mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix wrong release in sess_alloc_buffer() failed path (Paulo Alcantara) [RHEL-34672] - CIFS: Fix a potencially linear read overflow (Paulo Alcantara) [RHEL-34672] - cifs: use the correct max-length for dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: create sd context must be a multiple of 8 (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp sessions of dfs connections (Paulo Alcantara) [RHEL-34672] - cifs: added WARN_ON for all the count decrements (Paulo Alcantara) [RHEL-34672] - cifs: fix missing null session check in mount (Paulo Alcantara) [RHEL-34672] - cifs: handle reconnect of tcon when there is no cached dfs referral (Paulo Alcantara) [RHEL-34672] - cifs: fix the out of range assignment to bit fields in parse_server_interfaces (Paulo Alcantara) [RHEL-34672] - smb3: fix typo in header file (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: Add support for negotiating signing algorithm (Paulo Alcantara) [RHEL-34672] - cifs: prevent NULL deref in cifs_compose_mount_options() (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL dereference in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - smbdirect: missing rc checks while waiting for rdma events (Paulo Alcantara) [RHEL-34672] - cifs: Avoid field over-reading memcpy() (Paulo Alcantara) [RHEL-34672] - smb311: remove dead code for non compounded posix query info (Paulo Alcantara) [RHEL-34672] - cifs: fix SMB1 error path in cifs_get_file_info_unix (Paulo Alcantara) [RHEL-34672] - smb3: fix uninitialized value for port in witness protocol move (Paulo Alcantara) [RHEL-34672] - cifs: fix unneeded null check (Paulo Alcantara) [RHEL-34672] - cifs: use SPDX-Licence-Identifier (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in cifs_debug.c (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in smb2misc.c (Paulo Alcantara) [RHEL-34672] - cifs: missed ref-counting smb session in find (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp servers with dfs mounts (Paulo Alcantara) [RHEL-34672] - cifs: set a minimum of 2 minutes for refreshing dfs cache (Paulo Alcantara) [RHEL-34672] - cifs: Remove unused inline function is_sysvol_or_netlogon() (Paulo Alcantara) [RHEL-34672] - cifs: remove duplicated prototype (Paulo Alcantara) [RHEL-34672] - cifs: fix ipv6 formating in cifs_ses_add_channel (Paulo Alcantara) [RHEL-34672] - cifs: fix string declarations and assignments in tracepoints (Paulo Alcantara) [RHEL-34672] - cifs: fix memory leak in smb2_copychunk_range (Paulo Alcantara) [RHEL-34672] - SMB3: incorrect file id in requests compounded with open (Paulo Alcantara) [RHEL-34672] - smb3: if max_channels set to more than one channel request multichannel (Paulo Alcantara) [RHEL-34672] - smb3: do not attempt multichannel to server which does not support it (Paulo Alcantara) [RHEL-34672] - smb3: when mounting with multichannel include it in requested capabilities (Paulo Alcantara) [RHEL-34672] - cifs: simplify SWN code with dummy funcs instead of ifdefs (Paulo Alcantara) [RHEL-34672] - cifs: log mount errors using cifs_errorf() (Paulo Alcantara) [RHEL-34672] - cifs: switch build_path_from_dentry() to using dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: fix out-of-bound memory access when calling smb3_notify() at mount point (Paulo Alcantara) [RHEL-34672] - cifs: allocate buffer in the caller of build_path_from_dentry() (Paulo Alcantara) [RHEL-34672] - cifs: make build_path_from_dentry() return const char * (Paulo Alcantara) [RHEL-34672] - cifs: remove old dead code (Paulo Alcantara) [RHEL-34672] - fs: cifs: Remove repeated struct declaration (Paulo Alcantara) [RHEL-34672] - cifs: have cifs_fattr_to_inode() refuse to change type on live inode (Paulo Alcantara) [RHEL-34672] - cifs: have ->mkdir() handle race with another client sanely (Paulo Alcantara) [RHEL-34672] - do_cifs_create(): don't set ->i_mode of something we had not created (Paulo Alcantara) [RHEL-34672] - cifs: Silently ignore unknown oplock break handle (Paulo Alcantara) [RHEL-34672] - cifs: change noisy error message to FYI (Paulo Alcantara) [RHEL-34672] - cifs: print MIDs in decimal notation (Paulo Alcantara) [RHEL-34672] - cifs: minor simplification to smb2_is_network_name_deleted (Paulo Alcantara) [RHEL-34672] - TCON Reconnect during STATUS_NETWORK_NAME_DELETED (Paulo Alcantara) [RHEL-34672] - cifs: clarify hostname vs ip address in /proc/fs/cifs/DebugData (Paulo Alcantara) [RHEL-34672] - cifs: change confusing field serverName (to ip_addr) (Paulo Alcantara) [RHEL-34672] - cifs: Reformat DebugData and index connections by conn_id. (Paulo Alcantara) [RHEL-34672] - cifs: Identify a connection by a conn_id. (Paulo Alcantara) [RHEL-34672] - smb3: negotiate current dialect (SMB3.1.1) when version 3 or greater requested (Paulo Alcantara) [RHEL-34672] - smb3: Fix out-of-bounds bug in SMB2_negotiate() (Paulo Alcantara) [RHEL-34672] - fs/cifs: Simplify bool comparison. (Paulo Alcantara) [RHEL-34672] - fs/cifs: Assign boolean values to a bool variable (Paulo Alcantara) [RHEL-34672] - cifs: Avoid error pointer dereference (Paulo Alcantara) [RHEL-34672] - cifs: Re-indent cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Unlock on errors in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Delete a stray unlock in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Tracepoints and logs for tracing credit changes. (Paulo Alcantara) [RHEL-34672] - cifs: Fix some error pointers handling detected by static checker (Paulo Alcantara) [RHEL-34672] - smb3: remind users that witness protocol is experimental (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: do not log warning message if server doesn't populate salt (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: update comments clarifying SPNEGO info in negprot response (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot rsp (Paulo Alcantara) [RHEL-34672] - SMB3: avoid confusing warning message on mount to Azure (Paulo Alcantara) [RHEL-34672] - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (Nigel Croxon) [RHEL-46662] {CVE-2024-39476} - net: fix information leakage in /proc/net/ptype (Hangbin Liu) [RHEL-44000] {CVE-2022-48757} - usb: typec: ucsi: Limit read size on v1.2 (Desnes Nunes) [RHEL-37286] {CVE-2024-35924} - minmax: relax check to allow comparison between unsigned arguments and signed constants (Desnes Nunes) [RHEL-37286] - minmax: allow comparisons of 'int' against 'unsigned char/short' (Desnes Nunes) [RHEL-37286] - minmax: allow min()/max()/clamp() if the arguments have the same signedness. (Desnes Nunes) [RHEL-37286] - minmax: add umin(a, b) and umax(a, b) (Desnes Nunes) [RHEL-37286] - minmax: fix header inclusions (Desnes Nunes) [RHEL-37286] - minmax: clamp more efficiently by avoiding extra comparison (Desnes Nunes) [RHEL-37286] - minmax: sanity check constant bounds when clamping (Desnes Nunes) [RHEL-37286] - tracing: Define the is_signed_type() macro once (Desnes Nunes) [RHEL-37286] - linux/bits.h: fix compilation error with GENMASK (Desnes Nunes) [RHEL-37286] - x86/apic: Mask IOAPIC entries when disabling the local APIC (Lenny Szubowicz) [RHEL-18077] - userfaultfd: fix a race between writeprotect and exit_mmap() (Rafael Aquini) [RHEL-38410] {CVE-2021-47461} - mm: khugepaged: skip huge page collapse for special files (Waiman Long) [RHEL-38446] {CVE-2021-47491} - cachefiles: fix memory leak in cachefiles_add_cache() (Andrey Albershteyn) [RHEL-33109] {CVE-2024-26840} - drm/amd/display: Implement bounds check for stream encoder creation in DCN301 (Michel Dänzer) [RHEL-31429] {CVE-2024-26660} - net/mlx5: Discard command completions in internal error (Kamal Heib) [RHEL-44231] {CVE-2024-38555} - drm: Don't unref the same fb many times by mistake due to deadlock handling (CKI Backport Bot) [RHEL-29011] {CVE-2023-52486} - md: fix resync softlockup when bitmap size is less than array size (Nigel Croxon) [RHEL-43942] {CVE-2024-38598} - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation (Davide Caratti) [RHEL-39712] {CVE-2024-36017} - netfilter: nf_tables: discard table flag update with pending basechain deletion (Phil Sutter) [RHEL-37205] {CVE-2024-35897} - netfilter: nf_tables: reject table flag and netdev basechain updates (Phil Sutter) [RHEL-37205] - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (Ewan D. Milne) [RHEL-40172] {CVE-2024-36924} - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (Ewan D. Milne) [RHEL-40172] {CVE-2024-36952} - netfilter: nf_tables: fix memleak in map from abort path (Phil Sutter) [RHEL-35052] {CVE-2024-27011} - netfilter: nf_tables: reject new basechain after table flag update (Phil Sutter) [RHEL-37193] {CVE-2024-35900} - netfilter: nf_tables: flush pending destroy work before exit_net release (Phil Sutter) [RHEL-37197] {CVE-2024-35899} - netfilter: complete validation of user input (Phil Sutter) [RHEL-37210] - netfilter: validate user input for expected length (Phil Sutter) [RHEL-37210] {CVE-2024-35896} - netfilter: tproxy: bail out if IP has been disabled on the device (Phil Sutter) [RHEL-44363] {CVE-2024-36270} - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (Phil Sutter) [RHEL-44532] {CVE-2024-36286} - netfilter: nf_tables: do not compare internal table flags on updates (Phil Sutter) [RHEL-35114] {CVE-2024-27065} - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (Phil Sutter) [RHEL-35028] {CVE-2024-27019} - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (Phil Sutter) [RHEL-35024] {CVE-2024-27020} - netfilter: nf_tables: __nft_expr_type_get() selects specific family type (Phil Sutter) [RHEL-35024] - netfilter: conntrack: serialize hash resizes and cleanups (Phil Sutter) [RHEL-37703] {CVE-2021-47408} - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (Phil Sutter) [RHEL-34217] {CVE-2024-26925} - netfilter: nf_tables: release batch on table validation from abort path (Phil Sutter) [RHEL-34217] - ipvlan: add ipvlan_route_v6_outbound() helper (Davide Caratti) [RHEL-38319] {CVE-2023-52796} - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.23.1.rt7.364.el8_10 [RHEL-59541] - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002] - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924} - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042} - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070} - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898} - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301} - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976} - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540} - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284} - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857} - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924} - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983} - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854} - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936} - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093} - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961} - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880} - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244} - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984} - [rt] build kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 [RHEL-53529] - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071} - [rt] build kernel-rt-4.18.0-553.21.1.rt7.362.el8_10 [RHEL-53529] - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874] - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558} - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441} - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904} - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322} - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246} - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008} - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228} - [rt] build kernel-rt-4.18.0-553.20.1.rt7.361.el8_10 [RHEL-53529] - KVM: arm64: Disassociate vcpus from redistributor region on teardown (Shaoqin Huang) [RHEL-48417] {CVE-2024-40989} - devres: Fix memory leakage caused by driver API devm_free_percpu() (CKI Backport Bot) [RHEL-55597] {CVE-2024-43871} - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (Izabela Bakollari) [RHEL-26680] {CVE-2024-26600} - nvmet-fc: avoid deadlock on delete association path (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - nvmet-fc: release reference on target port (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - ACPI: LPIT: Avoid u32 multiplication overflow (Mark Langsdorf) [RHEL-37062] {CVE-2023-52683} - sched/deadline: Fix task_struct reference leak (Phil Auld) [RHEL-50904] {CVE-2024-41023} - nfsd: fix crash on LOCKT on reexported NFSv3 (Benjamin Coddington) [RHEL-31515] - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path (CKI Backport Bot) [RHEL-26570] {CVE-2024-26595} - mlxsw: spectrum_acl_tcam: Move devlink param to TCAM code (Ivan Vecera) [RHEL-26570] {CVE-2024-26595} - ACPI: extlog: fix NULL pointer dereference check (Mark Langsdorf) [RHEL-29110] {CVE-2023-52605} - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() (Mark Langsdorf) [RHEL-33198] {CVE-2024-26894} - mm: prevent derefencing NULL ptr in pfn_section_valid() (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - mm, kmsan: fix infinite recursion due to RCU critical section (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - cipso: make cipso_v4_skbuff_delattr() fully remove the CIPSO options (Ondrej Mosnacek) [RHEL-30904] - cipso: fix total option length computation (Ondrej Mosnacek) [RHEL-30904] - ext4: do not create EA inode under buffer lock (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: check the return value of ext4_xattr_inode_dec_ref() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (Carlos Maiolino) [RHEL-48507] {CVE-2024-40998} - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - [rt] build kernel-rt-4.18.0-553.19.1.rt7.360.el8_10 [RHEL-53529] - drm/i915/vma: Fix UAF on destroy against retire race (Mika Penttilä) [RHEL-35222] {CVE-2024-26939} - RHEL-48620 (Kenneth Yin) [RHEL-48620] - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (CKI Backport Bot) [RHEL-42721] {CVE-2024-26855} - net: usb: asix: do not force pause frames support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix "can't send until first packet is send" issue (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix modprobe "sysfs: cannot create duplicate filename" (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: add proper error handling of usb read errors (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix wrong return value in asix_check_host_enable() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix uninit-value in asix_mdio_read() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: fix boolconv.cocci warnings (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: do not call phy_disconnect() for ax88178 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: move embedded PHY detection as early as possible (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix uninit value bugs (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add missing stop (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: suspend PHY on driver probe (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: manage PHY PM from MAC (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: add error handling for asix_mdio_* functions (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add phylib support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: refactor asix_read_phy_addr() and handle errors on return (Ken Cox) [RHEL-28108] {CVE-2021-47101} - SUNRPC: always free ctxt when freeing deferred request (Jay Shin) [RHEL-40936] - SUNRPC: double free xprt_ctxt while still in use (Jay Shin) [RHEL-40936] - SUNRPC: Remove svc_rqst::rq_xprt_hlen (Jay Shin) [RHEL-40936] - SUNRPC: Remove dead code in svc_tcp_release_rqst() (Jay Shin) [RHEL-40936] - x86/bugs: Extend VMware Retbleed workaround to Nehalem & earlier CPUs (Waiman Long) [RHEL-48646] - wifi: iwlwifi: read txq->read_ptr under lock (Jose Ignacio Tornos Martinez) [RHEL-39797] {CVE-2024-36922} - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (John Meneghini) [RHEL-39908] {CVE-2024-36919} - nbd: always initialize struct msghdr completely (Ming Lei) [RHEL-29498] {CVE-2024-26638} - block: don't call rq_qos_ops->done_bio if the bio isn't tracked (Ming Lei) [RHEL-42151] {CVE-2021-47412} - nvmet: fix a possible leak when destroy a ctrl during qp establishment (Maurizio Lombardi) [RHEL-52013] {CVE-2024-42152} - ipv6: prevent NULL dereference in ip6_output() (Sabrina Dubroca) [RHEL-39912] {CVE-2024-36901} - ppp: reject claimed-as-LCP but actually malformed packets (Guillaume Nault) [RHEL-51052] {CVE-2024-41044} - leds: trigger: Unregister sysfs attributes before calling deactivate() (CKI Backport Bot) [RHEL-54834] {CVE-2024-43830} - crypto: bcm - Fix pointer arithmetic (cki-backport-bot) [RHEL-44108] {CVE-2024-38579} - scsi: qedf: Ensure the copied buf is NUL terminated (John Meneghini) [RHEL-44195] {CVE-2024-38559} - x86/bhi: Avoid warning in #DB handler due to BHI mitigation (Waiman Long) [RHEL-53657] {CVE-2024-42240} - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (CKI Backport Bot) [RHEL-47529] {CVE-2024-40901} - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (CKI Backport Bot) [RHEL-39843] {CVE-2024-36902} - net: usb: ax88179_178a: improve link status logs (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: improve reset check (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: fix link status when link is set to down/up (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: avoid writing the mac address before first reading (Jose Ignacio Tornos Martinez) [RHEL-45167] - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - media: cec: cec-api: add locking in cec_release() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid confusing "transmit timed out" message (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid recursive cec_claim_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: remove length check of Timer Status (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: count low-drive, error and arb-lost conditions (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add note about *_from_edid() function usage in drm (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_unconfigured() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_nb_transmit_canceled() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: don't set last_initiator if tx in progress (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: disable adapter in cec_devnode_unregister (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: not all messages were passed on when monitoring (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add support for Absolute Volume Control (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: log when claiming LA fails unexpectedly (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: drop activate_cnt, use state info instead (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: reconfigure if the PA changes during configuration (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: fix is_configuring state (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: stop trying LAs on CEC_TX_STATUS_TIMEOUT (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't unconfigure if already unconfigured (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add optional adap_configured callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add xfer_timeout_ms field (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: use call_op and check for !unregistered (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix interrupt en/disable handling (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: drop unused 'enabled' field from struct cec_pin (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix off-by-one SFT check (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: rename timer overrun variables (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: correctly pass on reply results (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: abort if the current transmit was canceled (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: call enable_adap on s_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: media/cec.h: document cec_adapter fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix a deadlock situation (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: safely unhook lists in cec_data (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: copy sequence field for the reply (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix trivial style warnings (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: add 'unregistered' checks (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't use flush_scheduled_work() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: Use fallthrough pseudo-keyword (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: remove unused waitq and phys_addrs fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: silence shift wrapping warning in __cec_s_log_addrs() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: move the core to a separate directory (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - net/iucv: Avoid explicit cpumask var allocation on stack (CKI Backport Bot) [RHEL-51631] {CVE-2024-42094} - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (Dick Kennedy) [RHEL-40400] - KVM: selftests: Make hyperv_clock require TSC based system clocksource (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Run clocksource dependent tests with hyperv_clocksource_tsc_page too (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Use generic sys_clocksource_is_tsc() in vmx_nested_tsc_scaling_test (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Generalize check_clocksource() from kvm_clock_test (Vitaly Kuznetsov) [RHEL-19027] - firmware: cs_dsp: Return error if block header overflows file (CKI Backport Bot) [RHEL-53646] {CVE-2024-42238} - firmware: cs_dsp: Validate payload length before processing block (CKI Backport Bot) [RHEL-53638] {CVE-2024-42237} - mm, slub: fix potential memoryleak in kmem_cache_open() (Waiman Long) [RHEL-38404] {CVE-2021-47466} - slub: don't panic for memcg kmem cache creation failure (Waiman Long) [RHEL-38404] {CVE-2021-47466} - wifi: ath11k: fix htt pktlog locking (Jose Ignacio Tornos Martinez) [RHEL-38317] {CVE-2023-52800} - wifi: ath11k: fix dfs radar event locking (Jose Ignacio Tornos Martinez) [RHEL-38165] {CVE-2023-52798} - lib/generic-radix-tree.c: Don't overflow in peek() (Waiman Long) [RHEL-37737] {CVE-2021-47432} - include/linux/generic-radix-tree.h: replace kernel.h with the necessary inclusions (Waiman Long) [RHEL-37737] {CVE-2021-47432} - EDAC/i10nm: Skip the absent memory controllers (Aristeu Rozanski) [RHEL-43236] - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (John Meneghini) [RHEL-38197] {CVE-2023-52809} - gfs2: Fix potential glock use-after-free on unmount (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: simplify gdlm_put_lock with out_free label (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: Remove ill-placed consistency check (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - nvme-fc: do not wait in vain when unloading module (Ewan D. Milne) [RHEL-33083] {CVE-2024-26846} - HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts (CKI Backport Bot) [RHEL-49698] {CVE-2022-48866} - scsi: qedf: Set qed_slowpath_params to zero before use (John Meneghini) [RHEL-9797] - scsi: qedf: Wait for stag work during unload (John Meneghini) [RHEL-9797] - scsi: qedf: Don't process stag work during unload and recovery (John Meneghini) [RHEL-9797] - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - mm: avoid overflows in dirty throttling logic (Audra Mitchell) [RHEL-51840] {CVE-2024-42131} - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - ACPI: fix NULL pointer dereference (Mark Langsdorf) [RHEL-37897] {CVE-2021-47289} - [rt] build kernel-rt-4.18.0-553.18.1.rt7.359.el8_10 [RHEL-53529] - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING (Ewan D. Milne) [RHEL-39805] {CVE-2024-36920} - tun: limit printing rate when illegal packet received by tun dev (Jon Maloy) [RHEL-35046] {CVE-2024-27013} - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu/mes: fix use-after-free issue (Michel Dänzer) [RHEL-44043] {CVE-2024-38581} - drm/amdgpu: Fix the null pointer when load rlc firmware (Michel Dänzer) [RHEL-30603] {CVE-2024-26649} - drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (Michel Dänzer) [RHEL-35160] {CVE-2024-27042} - net/sched: Fix UAF when resolving a clash (Xin Long) [RHEL-51014] {CVE-2024-41040} - tcp_metrics: validate source addr length (Guillaume Nault) [RHEL-52025] {CVE-2024-42154} - NFSv4/pnfs: Fix a use-after-free bug in open (Benjamin Coddington) [RHEL-35508] - NFSv4: Don't hold the layoutget locks across multiple RPC calls (Benjamin Coddington) [RHEL-35508] - scsi: qedf: Make qedf_execute_tmf() non-preemptible (John Meneghini) [RHEL-51799] {CVE-2024-42124} - Input: elantech - fix stack out of bound access in elantech_change_report_id() (CKI Backport Bot) [RHEL-41938] {CVE-2021-47097} - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (CKI Backport Bot) [RHEL-28982] {CVE-2023-52478} - drm/radeon: fix UBSAN warning in kv_dpm.c (CKI Backport Bot) [RHEL-48399] {CVE-2024-40988} - usb: core: Don't hold the device lock while sleeping in do_proc_control() (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - USB: core: Make do_proc_control() and do_proc_bulk() killable (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - scsi: qedi: Fix crash while reading debugfs attribute (CKI Backport Bot) [RHEL-48327] {CVE-2024-40978} - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CKI Backport Bot) [RHEL-48309] {CVE-2024-40977} - net: tcp: accept old ack during closing (Jamie Bainbridge) [RHEL-52433] - wifi: iwlwifi: mvm: don't read past the mfuart notifcation (CKI Backport Bot) [RHEL-48016] {CVE-2024-40941} - net/iucv: fix use after free in iucv_sock_close() (Mete Durlu) [RHEL-53988] - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (CKI Backport Bot) [RHEL-47908] {CVE-2024-40929} - Input: aiptek - properly check endpoint type (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - use descriptors of current altsetting (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - fix endpoint sanity check (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB (CKI Backport Bot) [RHEL-52373] {CVE-2024-42226} - wifi: mt76: replace skb_put with skb_put_zero (CKI Backport Bot) [RHEL-52366] {CVE-2024-42225} - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (CKI Backport Bot) [RHEL-47776] {CVE-2024-40912} - wifi: cfg80211: Lock wiphy in cfg80211_get_station (CKI Backport Bot) [RHEL-47758] {CVE-2024-40911} - VMCI: Use struct_size() in kmalloc() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() (Steve Best) [RHEL-37325] {CVE-2024-35944} - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values (Jose Ignacio Tornos Martinez) [RHEL-51761] {CVE-2024-42114} - usb: atm: cxacru: fix endpoint checking in cxacru_bind() (CKI Backport Bot) [RHEL-51442] {CVE-2024-41097} - nfs: handle error of rpc_proc_register() in init_nfs_fs() (Scott Mayhew) [RHEL-39904] {CVE-2024-36939} - drm/radeon: check bo_va->bo is non-NULL before using it (CKI Backport Bot) [RHEL-51184] {CVE-2024-41060} - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). (CKI Backport Bot) [RHEL-51027] {CVE-2024-41041} - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (CKI Backport Bot) [RHEL-50961] {CVE-2024-41035} - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). (CKI Backport Bot) [RHEL-44408] {CVE-2024-37356} - tcp: avoid too many retransmit packets (Florian Westphal) [RHEL-48627] {CVE-2024-41007} - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() (Florian Westphal) [RHEL-48627] - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Florian Westphal) [RHEL-48627] - tcp: refactor tcp_retransmit_timer() (Florian Westphal) [RHEL-48627] - tcp: exit if nothing to retransmit on RTO timeout (Florian Westphal) [RHEL-48627] - netfilter: nf_tables: Reject tables of unsupported family (Florian Westphal) [RHEL-21418] {CVE-2023-6040} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.23.1.rt7.364.el8_10 [RHEL-59541] - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002] - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924} - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042} - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070} - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898} - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301} - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976} - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540} - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284} - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857} - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924} - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983} - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854} - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936} - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093} - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961} - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880} - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244} - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984} - [rt] build kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 [RHEL-53529] - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071} - [rt] build kernel-rt-4.18.0-553.21.1.rt7.362.el8_10 [RHEL-53529] - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874] - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558} - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441} - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904} - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322} - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246} - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008} - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228} - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.23.1.rt7.364.el8_10 [RHEL-59541] - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002] - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924} - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042} - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070} - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898} - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301} - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976} - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540} - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284} - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857} - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924} - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983} - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854} - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936} - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093} - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961} - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880} - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244} - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - [rt] build kernel-rt-4.18.0-553.35.1.rt7.376.el8_10 [RHEL-72569] - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480] - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480] - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396] - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - [rt] build kernel-rt-4.18.0-553.35.1.rt7.376.el8_10 [RHEL-72569] - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480] - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480] - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396] - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - [rt] build kernel-rt-4.18.0-553.35.1.rt7.376.el8_10 [RHEL-72569] - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480] - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480] - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396] - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.5.1.rt7.346.el8_10 [RHEL-34640] - tools/power/turbostat: Fix uncore frequency file string (David Arcari) [RHEL-29238] - tools/power turbostat: Expand probe_intel_uncore_frequency() (David Arcari) [RHEL-29238] - uio: Fix use-after-free in uio_open (Ricardo Robaina) [RHEL-26232] {CVE-2023-52439} - net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (Ken Cox) [RHEL-27316] {CVE-2021-47013} - keys: Fix linking a duplicate key to a keyring's assoc_array (David Howells) [RHEL-30772] - keys: Hoist locking out of __key_link_begin() (David Howells) [RHEL-30772] - keys: Break bits out of key_unlink() (David Howells) [RHEL-30772] - keys: Change keyring_serialise_link_sem to a mutex (David Howells) [RHEL-30772] - wifi: brcm80211: handle pmk_op allocation failure (Jose Ignacio Tornos Martinez) [RHEL-35150] {CVE-2024-27048} - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work (Jose Ignacio Tornos Martinez) [RHEL-35140] {CVE-2024-27052} - wifi: iwlwifi: mvm: ensure offloading TID queue exists (Jose Ignacio Tornos Martinez) [RHEL-35130] {CVE-2024-27056} - wifi: mt76: mt7921e: fix use-after-free in free_irq() (Jose Ignacio Tornos Martinez) [RHEL-34866] {CVE-2024-26892} - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete (Jose Ignacio Tornos Martinez) [RHEL-34189] {CVE-2024-26897} - wifi: iwlwifi: mvm: fix a crash when we run out of stations (Jose Ignacio Tornos Martinez) [RHEL-31547] {CVE-2024-26693} - wifi: iwlwifi: fix double-free bug (Jose Ignacio Tornos Martinez) [RHEL-31543] {CVE-2024-26694} - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (Jose Ignacio Tornos Martinez) [RHEL-29089] {CVE-2023-52594} - wifi: rt2x00: restart beacon queue when hardware reset (Jose Ignacio Tornos Martinez) [RHEL-29093] {CVE-2023-52595} - wifi: iwlwifi: fix a memory corruption (Jose Ignacio Tornos Martinez) [RHEL-28903] {CVE-2024-26610} - [rt] build kernel-rt-4.18.0-553.4.1.rt7.345.el8_10 [RHEL-34640] - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117] - net/mlx5e: Prevent deadlock while disabling aRFS (Kamal Heib) [RHEL-35041] {CVE-2024-27014} - x86/tsc: Defer marking TSC unstable to a worker (Wander Lairson Costa) [RHEL-32676] - x86/smpboot: Make TSC synchronization function call based (Wander Lairson Costa) [RHEL-32676] - net: usb: fix possible use-after-free in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - net: usb: fix memory leak in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - [rt] build kernel-rt-4.18.0-552.3.1.rt7.344.el8_10 [RHEL-34640] - netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (Phil Sutter) [RHEL-30076] {CVE-2024-26643} - netfilter: nf_tables: disallow anonymous set with timeout flag (Phil Sutter) [RHEL-30080] {CVE-2024-26642} - selftests/bpf: Fix pyperf180 compilation failure with clang18 (Artem Savkov) [RHEL-35576] - md/raid5: fix atomicity violation in raid5_cache_count (Nigel Croxon) [RHEL-27930] {CVE-2024-23307} - usb: ulpi: Fix debugfs directory leak (Desnes Nunes) [RHEL-33287] {CVE-2024-26919} - powerpc/pseries: Fix potential memleak in papr_get_attr() (Mamatha Inamdar) [RHEL-35213] {CVE-2022-48669} - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (Desnes Nunes) [RHEL-35122] {CVE-2024-27059} - NFSv4: fairly test all delegations on a SEQ4_ revocation (Benjamin Coddington) [RHEL-34912] - USB: core: Fix deadlock in usb_deauthorize_interface() (Desnes Nunes) [RHEL-35002] {CVE-2024-26934} - usb: xhci: Add error handling in xhci_map_urb_for_dma (Desnes Nunes) [RHEL-34958] {CVE-2024-26964} - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (Ewan D. Milne) [RHEL-35076] {CVE-2024-26993} - xhci: handle isoc Babble and Buffer Overrun events properly (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - xhci: process isoc TD properly when there was a transaction error mid TD. (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - USB: core: Fix deadlock in port "disable" sysfs attribute (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - USB: core: Add hub_get() and hub_put() routines (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - netfilter: ipset: Missing gc cancellations fixed (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix performance regression in swap operation (Phil Sutter) [RHEL-30521] - netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test (Phil Sutter) [RHEL-30521] - x86/apic/x2apic: Fix a NULL pointer deref when handling a dying cpu (David Arcari) [RHEL-32516] - x86/coco: Disable 32-bit emulation by default on TDX and SEV (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Make IA32_EMULATION boot time configurable (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/elf: Make loading of 32bit processes depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Rename ignore_sysret() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/cpu: Don't write CSTAR MSR on Intel CPUs (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Introduce ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - [rt] build kernel-rt-4.18.0-552.2.1.rt7.343.el8_10 [RHEL-34640] - s390/ptrace: handle setting of fpc register correctly (Tobias Huschle) [RHEL-29106] {CVE-2023-52598} - net/smc: fix illegal rmb_desc access in SMC-D connection dump (Tobias Huschle) [RHEL-27746] {CVE-2024-26615} - wifi: mac80211: fix race condition on enabling fast-xmit (Jose Ignacio Tornos Martinez) [RHEL-31664] {CVE-2024-26779} - powerpc/fadump: make is_kdump_kernel() return false when fadump is active (Mamatha Inamdar) [RHEL-24401] - vmcore: remove dependency with is_kdump_kernel() for exporting vmcore (Mamatha Inamdar) [RHEL-24401] - mtd: require write permissions for locking and badblock ioctls (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - mtd: properly check all write ioctls for permissions (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - pid: take a reference when initializing `cad_pid` (Waiman Long) [RHEL-29420] {CVE-2021-47118} - i2c: i801: Don't generate an interrupt on bus reset (Prarit Bhargava) [RHEL-30325] {CVE-2021-47153} - RDMA/srpt: Do not register event handler until srpt device is fully setup (Kamal Heib) [RHEL-33224] {CVE-2024-26872} - ceph: switch to corrected encoding of max_xattr_size in mdsmap (Xiubo Li) [RHEL-26723] - ceph: switch to use cap_delay_lock for the unlink delay list (Xiubo Li) [RHEL-32870] - ceph: pass ino# instead of old_dentry if it's disconnected (Xiubo Li) [RHEL-32870] - fat: fix uninitialized field in nostale filehandles (Andrey Albershteyn) [RHEL-33186 RHEL-35108] {CVE-2024-26973} - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (Andrey Albershteyn) [RHEL-33186] {CVE-2024-26901} - idpf: limit the support to GCP only (Michal Schmidt) [RHEL-15652] - redhat/configs: enable CONFIG_IDPF (Michal Schmidt) [RHEL-15652] - idpf: remove the use of ETHTOOL_RING_USE_TCP_DATA_SPLIT (Michal Schmidt) [RHEL-15652] - idpf: workaround for unavailable skb page recycling (Michal Schmidt) [RHEL-15652] - idpf: always allocate a full page (Michal Schmidt) [RHEL-15652] - idpf: remove page pool stats code (Michal Schmidt) [RHEL-15652] - idpf: add minimal macros for __free(kfree) to work (Michal Schmidt) [RHEL-15652] - idpf: fixup include paths for RHEL 8 (Michal Schmidt) [RHEL-15652] - idpf: fix kernel panic on unknown packet types (Michal Schmidt) [RHEL-15652] - idpf: disable local BH when scheduling napi for marker packets (Michal Schmidt) [RHEL-15652] - idpf: remove dealloc vector msg err in idpf_intr_rel (Michal Schmidt) [RHEL-15652] - idpf: fix minor controlq issues (Michal Schmidt) [RHEL-15652] - idpf: prevent deinit uninitialized virtchnl core (Michal Schmidt) [RHEL-15652] - idpf: cleanup virtchnl cruft (Michal Schmidt) [RHEL-15652] - idpf: refactor idpf_recv_mb_msg (Michal Schmidt) [RHEL-15652] - idpf: add async_handler for MAC filter messages (Michal Schmidt) [RHEL-15652] - idpf: refactor remaining virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor queue related virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor vport virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: implement virtchnl transaction manager (Michal Schmidt) [RHEL-15652] - idpf: add idpf_virtchnl.h (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler padding in virtchnl2_ptype struct (Michal Schmidt) [RHEL-15652] - idpf: distinguish vports by the dev_port attribute (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler introduced padding in virtchnl2_rss_key struct (Michal Schmidt) [RHEL-15652] - idpf: fix corrupted frames and skb leaks in singleq mode (Michal Schmidt) [RHEL-15652] - idpf: refactor some missing field get/prep conversions (Michal Schmidt) [RHEL-15652] - idpf: add get/set for Ethtool's header split ringparam (Michal Schmidt) [RHEL-15652] - idpf: fix potential use-after-free in idpf_tso() (Michal Schmidt) [RHEL-15652] - idpf: cancel mailbox work in error path (Michal Schmidt) [RHEL-15652] - idpf: set scheduling mode for completion queue (Michal Schmidt) [RHEL-15652] - idpf: add SRIOV support and other ndo_ops (Michal Schmidt) [RHEL-15652] - idpf: add ethtool callbacks (Michal Schmidt) [RHEL-15652] - idpf: add singleq start_xmit and napi poll (Michal Schmidt) [RHEL-15652] - idpf: add RX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add TX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add splitq start_xmit (Michal Schmidt) [RHEL-15652] - idpf: initialize interrupts and enable vport (Michal Schmidt) [RHEL-15652] - idpf: configure resources for RX queues (Michal Schmidt) [RHEL-15652] - idpf: configure resources for TX queues (Michal Schmidt) [RHEL-15652] - idpf: add ptypes and MAC filter support (Michal Schmidt) [RHEL-15652] - idpf: add create vport and netdev configuration (Michal Schmidt) [RHEL-15652] - idpf: add core init and interrupt request (Michal Schmidt) [RHEL-15652] - idpf: add controlq init and reset checks (Michal Schmidt) [RHEL-15652] - idpf: add module register and probe functionality (Michal Schmidt) [RHEL-15652] - virtchnl: add virtchnl version 2 ops (Michal Schmidt) [RHEL-15652] - net: netdev_queue: netdev_txq_completed_mb(): fix wake condition (Michal Schmidt) [RHEL-15652] - net: piggy back on the memory barrier in bql when waking queues (Michal Schmidt) [RHEL-15652] - net: provide macros for commonly copied lockless queue stop/wake code (Michal Schmidt) [RHEL-15652] - [rt] build kernel-rt-4.18.0-552.1.1.rt7.342.el8_10 [RHEL-34640] - build: Update RTBZ for 8.10 z-stream builds (Denys Vlasenko) - redhat: set DIST to el8_10 and ZSTREAM to yes for 8.10 (Denys Vlasenko) - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (Prarit Bhargava) [RHEL-32590] {CVE-2021-47185} - net: mana: Fix Rx DMA datasize and skb_over_panic (Cathy Avery) [RHEL-32579] - RDMA/srpt: Support specifying the srpt_service_guid parameter (Kamal Heib) [RHEL-31710] {CVE-2024-26744} - RDMA/qedr: Fix qedr_create_user_qp error flow (Kamal Heib) [RHEL-31714] {CVE-2024-26743} - hwmon: (coretemp) Fix out-of-bounds memory access (David Arcari) [RHEL-31305] {CVE-2024-26664} - RDMA/irdma: Fix KASAN issue with tasklet (Kamal Heib) [RHEL-15776] - net: bridge: use DEV_STATS_INC() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: Fix unwanted sign extension in netdev_stats_to_stats64() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: add atomic_long_t to net_device_stats fields (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net/sched: act_ct: fix skb leak and crash on ooo frags (Xin Long) [RHEL-29467] {CVE-2023-52610} - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Jose Ignacio Tornos Martinez) [RHEL-28015] {CVE-2023-52528} - RDMA/core: Fix uninit-value access in ib_get_eth_speed() (Kamal Heib) [RHEL-30130] - RDMA/core: Get IB width and speed from netdev (Kamal Heib) [RHEL-30130] - cpufreq: intel_pstate: Add Emerald Rapids support in no-HWP mode (Prarit Bhargava) [RHEL-29444] - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add (Mamatha Inamdar) [RHEL-29118] {CVE-2023-52607} - powerpc/lib: Validate size for vector operations (Mamatha Inamdar) [RHEL-29114] {CVE-2023-52606} - usb: hub: Guard against accesses to uninitialized BOS descriptors (Desnes Nunes) [RHEL-28986] {CVE-2023-52477} - media: uvcvideo: Fix OOB read (Desnes Nunes) [RHEL-27940] {CVE-2023-52565} - media: pvrusb2: fix use after free on context disconnection (Desnes Nunes) [RHEL-26498] {CVE-2023-52445} - i2c: i801: Fix block process call transactions (Prarit Bhargava) [RHEL-26478] {CVE-2024-26593} - overlay: disable EVM (Coiby Xu) [RHEL-19863] - evm: add support to disable EVM on unsupported filesystems (Coiby Xu) [RHEL-19863] - evm: don't copy up 'security.evm' xattr (Coiby Xu) [RHEL-19863] - net: ena: Remove ena_select_queue (Kamal Heib) [RHEL-14286] - media: dvbdev: Fix memory leak in dvb_media_device_free() (Prarit Bhargava) [RHEL-27254] {CVE-2020-36777} - gfs2: Fix invalid metadata access in punch_hole (Andrew Price) [RHEL-28784] - i2c: Fix a potential use after free (Prarit Bhargava) [RHEL-26849] {CVE-2019-25162} - i2c: validate user data in compat ioctl (Prarit Bhargava) [RHEL-27022] {CVE-2021-46934} - platform/x86: think-lmi: Fix reference leak (Prarit Bhargava) [RHEL-28030] {CVE-2023-52520} - vhost: use kzalloc() instead of kmalloc() followed by memset() (Jon Maloy) [RHEL-21505] {CVE-2024-0340} - RDMA/siw: Fix connection failure handling (Kamal Heib) [RHEL-28042] {CVE-2023-52513} - vt: fix memory overlapping when deleting chars in the buffer (Waiman Long) [RHEL-27778 RHEL-27779] {CVE-2022-48627} - x86/fpu: Stop relying on userspace for info to fault in xsave buffer (Steve Best) [RHEL-26669] {CVE-2024-26603} - mptcp: fix double-free on socket dismantle (Davide Caratti) [RHEL-22773] {CVE-2024-26782} - crypto: akcipher - Disable signing and decryption (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: akcipher - default implementations for request callbacks (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: testmgr - split akcipher tests by a key type (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - workqueue: Warn when a rescuer could not be created (Waiman Long) [RHEL-22136] - RDMA/cma: Avoid GID lookups on iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/cma: Deduplicate error flow in cma_validate_port() (Benjamin Coddington) [RHEL-12456] - RDMA/core: Set gid_attr.ndev for iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/siw: Fabricate a GID on tun and loopback devices (Benjamin Coddington) [RHEL-12456] - eventpoll: fix missing wakeup for ovflist in ep_poll_callback (Luis Claudio R. Goncalves) [RHEL-23022] - [rt] build kernel-rt-4.18.0-552.rt7.341.el8 [RHEL-5332] - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248] - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248] - [rt] build kernel-rt-4.18.0-551.rt7.340.el8 [RHEL-5332] - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742} - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992] - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992] - [rt] build kernel-rt-4.18.0-550.rt7.339.el8 [RHEL-5332] - mm/sparsemem: fix race in accessing memory_section->usage (Waiman Long) [RHEL-28875 RHEL-28876] {CVE-2023-52489} - mm: use __pfn_to_section() instead of open coding it (Waiman Long) [RHEL-28875] {CVE-2023-52489} - [rt] build kernel-rt-4.18.0-549.rt7.338.el8 [RHEL-5332] - dm-integrity: align the outgoing bio in integrity_recheck (Benjamin Marzinski) [RHEL-29678] - dm-integrity: fix a memory leak when rechecking the data (Benjamin Marzinski) [RHEL-29678] - RDMA/mana_ib: Add CQ interrupt support for RAW QP (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: query device capabilities (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: register RDMA device with GDMA (Maxim Levitsky) [RHEL-23934] - net: mana: add msix index sharing between EQs (Maxim Levitsky) [RHEL-23934] - net: mana: Fix spelling mistake "enforecement" -> "enforcement" (Maxim Levitsky) [RHEL-23934] - net :mana :Add remaining GDMA stats for MANA to ethtool (Maxim Levitsky) [RHEL-23934] - net: mana: Fix oversized sge0 for GSO packets (Maxim Levitsky) [RHEL-23934] - net: mana: Fix TX CQE error handling (Maxim Levitsky) [RHEL-23934] - net: mana: Add gdma stats to ethtool output for mana (Maxim Levitsky) [RHEL-23934] - net: mana: Fix MANA VF unload when hardware is unresponsive (Maxim Levitsky) [RHEL-23934] - net: mana: Configure hwc timeout from hardware (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (Maxim Levitsky) [RHEL-23934] - [rt] build kernel-rt-4.18.0-548.rt7.337.el8 [RHEL-5332] - gitlab-ci: enable arm64/s390x/ppc64le debug builds (Michael Hofmann) - arm64: Add missing bits of AmpereOne Spectre-BHB mitigation (Mark Salter) [RHEL-29005] - [rt] enable CONFIG_DRM_MGAG200_IOBURST_WORKAROUND (Jocelyn Falempe) [RHEL-13214] - drm/mgag200: Add a workaround for low-latency (Jocelyn Falempe) [RHEL-13214] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - [rt] build kernel-rt-4.18.0-553.8.1.rt7.349.el8_10 [RHEL-40882] - udf: Fix NULL pointer dereference in udf_symlink function (Pavel Reichl) [RHEL-37769] {CVE-2021-47353} - net: ti: fix UAF in tlan_remove_one (Jose Ignacio Tornos Martinez) [RHEL-38940] {CVE-2021-47310} - ARM: footbridge: fix PCI interrupt mapping (Myron Stowe) [RHEL-26971] {CVE-2021-46909} - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (Kamal Heib) [RHEL-37454] {CVE-2024-36004} - net/mlx5e: Fix mlx5e_priv_init() cleanup flow (Kamal Heib) [RHEL-37424] {CVE-2024-35959} - net/mlx5: Properly link new fs rules into the tree (Kamal Heib) [RHEL-37420] {CVE-2024-35960} - net/mlx5e: fix a potential double-free in fs_any_create_groups (Kamal Heib) [RHEL-37091] {CVE-2023-52667} - net: ena: Fix incorrect descriptor free behavior (Kamal Heib) [RHEL-37428] {CVE-2024-35958} - mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - mISDN: fix possible use-after-free in HFC_cleanup() (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - implement dh fallback for primes > 4K (Vladis Dronov) [RHEL-35106] - crypto: qat - avoid division by zero (Vladis Dronov) [RHEL-35106] - crypto: qat - resolve race condition during AER recovery (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - use kcalloc_node() instead of kzalloc_node() (Vladis Dronov) [RHEL-35106] - [rt] Enable CONFIG_DRM_MGAG200_DISABLE_WRITECOMBINE (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Add an option to disable Write-Combine (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Fix caching setup for remapped video memory (Jocelyn Falempe) [RHEL-36172] - Revert "drm/mgag200: Add a workaround for low-latency" (Jocelyn Falempe) [RHEL-36172] - mptcp: fix data re-injection from stale subflow (Davide Caratti) [RHEL-33133] {CVE-2024-26826} - ipv6: sr: fix incorrect unregister order (Hangbin Liu) [RHEL-31730] - ipv6: sr: fix possible use-after-free and null-ptr-deref (Hangbin Liu) [RHEL-31730] {CVE-2024-26735} - net/bnx2x: Prevent access to a freed page in page_pool (Michal Schmidt) [RHEL-14195 RHEL-33243] {CVE-2024-26859} - bnx2x: new flag for track HW resource allocation (Michal Schmidt) [RHEL-14195 RHEL-33243] - bnx2x: fix page fault following EEH recovery (Michal Schmidt) [RHEL-14195 RHEL-33243] - x86: KVM: SVM: always update the x2avic msr interception (Maxim Levitsky) [RHEL-15495] {CVE-2023-5090} - EDAC/thunderx: Fix possible out-of-bounds string access (Aristeu Rozanski) [RHEL-26573] {CVE-2023-52464} - [rt] build kernel-rt-4.18.0-553.7.1.rt7.348.el8_10 [RHEL-34640] - net: qcom/emac: fix UAF in emac_remove (Ken Cox) [RHEL-37834] {CVE-2021-47311} - perf/core: Bail out early if the request AUX area is out of bound (Michael Petlan) [RHEL-38268] {CVE-2023-52835} - crypto: pcrypt - Fix hungtask for PADATA_RESET (Herbert Xu) [RHEL-38171] {CVE-2023-52813} - drm/amdgpu: fix use-after-free bug (Jocelyn Falempe) [RHEL-31240] {CVE-2024-26656} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash (Ivan Vecera) [RHEL-37008] {CVE-2024-35854} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update (Ivan Vecera) [RHEL-37004] {CVE-2024-35855} - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (Ivan Vecera) [RHEL-37012] {CVE-2024-35853} - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work (Ivan Vecera) [RHEL-37016] {CVE-2024-35852} - mlxsw: spectrum_acl_tcam: Fix warning during rehash (Ivan Vecera) [RHEL-37480] {CVE-2024-36007} - can: peak_pci: peak_pci_remove(): fix UAF (Jose Ignacio Tornos Martinez) [RHEL-38419] {CVE-2021-47456} - usbnet: fix error return code in usbnet_probe() (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - usbnet: sanity check for maxpacket (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - net/mlx5e: fix a double-free in arfs_create_groups (Kamal Heib) [RHEL-36920] {CVE-2024-35835} - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds (Jose Ignacio Tornos Martinez) [RHEL-38220] {CVE-2023-52878} - net: cdc_eem: fix tx fixup skb leak (Jose Ignacio Tornos Martinez) [RHEL-38080] {CVE-2021-47236} - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Jose Ignacio Tornos Martinez) [RHEL-38113] {CVE-2023-52703} - usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() (Desnes Nunes) [RHEL-38248] {CVE-2023-52877} - usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (Desnes Nunes) [RHEL-38240] {CVE-2023-52781} - gro: fix ownership transfer (Xin Long) [RHEL-37226] {CVE-2024-35890} - tipc: fix kernel warning when sending SYN message (Xin Long) [RHEL-38109] {CVE-2023-52700} - erspan: make sure erspan_base_hdr is present in skb->head (Xin Long) [RHEL-37230] {CVE-2024-35888} - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() (Bryan Gurney) [RHEL-17366] - scsi: mpi3mr: Sanitise num_phys (Bryan Gurney) [RHEL-17366] - netfilter: nf_tables: use timestamp to check for set element timeout (Phil Sutter) [RHEL-38023] {CVE-2024-27397} - net/ipv6: SKB symmetric hash should incorporate transport ports (Sabrina Dubroca) [RHEL-32061] - crypto: s390/aes - Fix buffer overread in CTR mode (Herbert Xu) [RHEL-37089] {CVE-2023-52669} - net: Save and restore msg_namelen in sock_sendmsg (Jamie Bainbridge) [RHEL-35893] - net: prevent address rewrite in kernel_bind() (Jamie Bainbridge) [RHEL-35893] - net: prevent rewrite of msg_name in sock_sendmsg() (Jamie Bainbridge) [RHEL-35893] - net: replace calls to sock->ops->connect() with kernel_connect() (Jamie Bainbridge) [RHEL-35893] - net: Avoid address overwrite in kernel_connect (Jamie Bainbridge) [RHEL-35893] - wifi: iwlwifi: dbg-tlv: ensure NUL termination (Jose Ignacio Tornos Martinez) [RHEL-37026] {CVE-2024-35845} - wifi: mac80211: fix potential sta-link leak (Jose Ignacio Tornos Martinez) [RHEL-36916] {CVE-2024-35838} - wifi: nl80211: reject iftype change with mesh ID change (Jose Ignacio Tornos Martinez) [RHEL-36884] {CVE-2024-27410} - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (Jose Ignacio Tornos Martinez) [RHEL-36807] {CVE-2024-35789} - Bluetooth: Avoid potential use-after-free in hci_error_reset (David Marlin) [RHEL-31826] {CVE-2024-26801} - tls: disable async encrypt/decrypt (Sabrina Dubroca) [RHEL-26362 RHEL-26409 RHEL-26420] {CVE-2024-26585 CVE-2024-26583 CVE-2024-26584} - Squashfs: check the inode number is not the invalid value of zero (Phillip Lougher) [RHEL-35096] {CVE-2024-26982} - ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/msg.c: update and document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/sem.c: document and update memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: update/document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: remove duplicated code (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (Kamal Heib) [RHEL-30582] {CVE-2023-52626} - Revert "ACPI: bus: Rework system-level device notification handling" (Prarit Bhargava) [RHEL-21486] - hwrng: core - Fix page fault dead lock on mmap-ed hwrng (Prarit Bhargava) [RHEL-29485] {CVE-2023-52615} - [rt] build kernel-rt-4.18.0-553.6.1.rt7.347.el8_10 [RHEL-34640] - cxgb4: Properly lock TX queue for the selftest. (John B. Wyatt IV) [RHEL-8779] - powerpc/powernv: Add a null pointer check in opal_event_init() (Mamatha Inamdar) [RHEL-37058] {CVE-2023-52686} - crypto: rsa - add a check for allocation failure (Vladis Dronov) [RHEL-35361] - crypto: rsa - allow only odd e and restrict value in FIPS mode (Vladis Dronov) [RHEL-35361] - KEYS: use kfree_sensitive with key (Vladis Dronov) [RHEL-35361] - lib/mpi: Extend the MPI library (only mpi_*_bit() part) (Vladis Dronov) [RHEL-35361] - net: ip_tunnel: prevent perpetual headroom growth (Felix Maurer) [RHEL-31814] {CVE-2024-26804} - s390/cpum_cf: make crypto counters upward compatible across machine types (Tobias Huschle) [RHEL-36048] - RDMA/mlx5: Fix fortify source warning while accessing Eth segment (Kamal Heib) [RHEL-33162] {CVE-2024-26907} - ovl: fix leaked dentry (Miklos Szeredi) [RHEL-27306] {CVE-2021-46972} - x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - x86/mm/vsyscall: Consider vsyscall page part of user address space (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - x86/mm: Add vsyscall address helper (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - mm/swap: fix race when skipping swapcache (Rafael Aquini) [RHEL-31644] {CVE-2024-26759} - swap: fix do_swap_page() race with swapoff (Rafael Aquini) [RHEL-31644] {CVE-2024-26759} - mm/swapfile: use percpu_ref to serialize against concurrent swapoff (Rafael Aquini) [RHEL-31644] {CVE-2024-26759} - mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions() (Rafael Aquini) [RHEL-29294] {CVE-2023-52560} - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr (Jiri Benc) [RHEL-29783] - block: null_blk: Fix handling of fake timeout request (Ming Lei) [RHEL-8130] - null_blk: fix poll request timeout handling (Ming Lei) [RHEL-8130] - block: null_blk: end timed out poll request (Ming Lei) [RHEL-8130] - block: null_blk: only set set->nr_maps as 3 if active poll_queues is > 0 (Ming Lei) [RHEL-8130] - null_blk: allow zero poll queues (Ming Lei) [RHEL-8130] - null_blk: Fix handling of submit_queues and poll_queues attributes (Ming Lei) [RHEL-8130] - null_blk: poll queue support (Ming Lei) [RHEL-8130] - null_blk: fix command timeout completion handling (Ming Lei) [RHEL-8130] - platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (Prarit Bhargava) [RHEL-27790] {CVE-2021-47073} - Bluetooth: avoid memcmp() out of bounds warning (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: hci_event: Fix coding style (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: hci_event: Fix using memcmp when comparing keys (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: Reject connection with the device which has same BD_ADDR (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: hci_event: Ignore NULL link key (David Marlin) [RHEL-3017] {CVE-2020-26555} - ppp_async: limit MRU to 64K (Guillaume Nault) [RHEL-31353] {CVE-2024-26675} - powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (Mamatha Inamdar) [RHEL-37078] {CVE-2023-52675} - tcp: do not accept ACK of bytes we never sent (Xin Long) [RHEL-21952] - [rt] build kernel-rt-4.18.0-553.5.1.rt7.346.el8_10 [RHEL-34640] - tools/power/turbostat: Fix uncore frequency file string (David Arcari) [RHEL-29238] - tools/power turbostat: Expand probe_intel_uncore_frequency() (David Arcari) [RHEL-29238] - uio: Fix use-after-free in uio_open (Ricardo Robaina) [RHEL-26232] {CVE-2023-52439} - net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (Ken Cox) [RHEL-27316] {CVE-2021-47013} - keys: Fix linking a duplicate key to a keyring's assoc_array (David Howells) [RHEL-30772] - keys: Hoist locking out of __key_link_begin() (David Howells) [RHEL-30772] - keys: Break bits out of key_unlink() (David Howells) [RHEL-30772] - keys: Change keyring_serialise_link_sem to a mutex (David Howells) [RHEL-30772] - wifi: brcm80211: handle pmk_op allocation failure (Jose Ignacio Tornos Martinez) [RHEL-35150] {CVE-2024-27048} - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work (Jose Ignacio Tornos Martinez) [RHEL-35140] {CVE-2024-27052} - wifi: iwlwifi: mvm: ensure offloading TID queue exists (Jose Ignacio Tornos Martinez) [RHEL-35130] {CVE-2024-27056} - wifi: mt76: mt7921e: fix use-after-free in free_irq() (Jose Ignacio Tornos Martinez) [RHEL-34866] {CVE-2024-26892} - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete (Jose Ignacio Tornos Martinez) [RHEL-34189] {CVE-2024-26897} - wifi: iwlwifi: mvm: fix a crash when we run out of stations (Jose Ignacio Tornos Martinez) [RHEL-31547] {CVE-2024-26693} - wifi: iwlwifi: fix double-free bug (Jose Ignacio Tornos Martinez) [RHEL-31543] {CVE-2024-26694} - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (Jose Ignacio Tornos Martinez) [RHEL-29089] {CVE-2023-52594} - wifi: rt2x00: restart beacon queue when hardware reset (Jose Ignacio Tornos Martinez) [RHEL-29093] {CVE-2023-52595} - wifi: iwlwifi: fix a memory corruption (Jose Ignacio Tornos Martinez) [RHEL-28903] {CVE-2024-26610} - [rt] build kernel-rt-4.18.0-553.4.1.rt7.345.el8_10 [RHEL-34640] - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117] - net/mlx5e: Prevent deadlock while disabling aRFS (Kamal Heib) [RHEL-35041] {CVE-2024-27014} - x86/tsc: Defer marking TSC unstable to a worker (Wander Lairson Costa) [RHEL-32676] - x86/smpboot: Make TSC synchronization function call based (Wander Lairson Costa) [RHEL-32676] - net: usb: fix possible use-after-free in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - net: usb: fix memory leak in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - [rt] build kernel-rt-4.18.0-552.3.1.rt7.344.el8_10 [RHEL-34640] - netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (Phil Sutter) [RHEL-30076] {CVE-2024-26643} - netfilter: nf_tables: disallow anonymous set with timeout flag (Phil Sutter) [RHEL-30080] {CVE-2024-26642} - selftests/bpf: Fix pyperf180 compilation failure with clang18 (Artem Savkov) [RHEL-35576] - md/raid5: fix atomicity violation in raid5_cache_count (Nigel Croxon) [RHEL-27930] {CVE-2024-23307} - usb: ulpi: Fix debugfs directory leak (Desnes Nunes) [RHEL-33287] {CVE-2024-26919} - powerpc/pseries: Fix potential memleak in papr_get_attr() (Mamatha Inamdar) [RHEL-35213] {CVE-2022-48669} - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (Desnes Nunes) [RHEL-35122] {CVE-2024-27059} - NFSv4: fairly test all delegations on a SEQ4_ revocation (Benjamin Coddington) [RHEL-34912] - USB: core: Fix deadlock in usb_deauthorize_interface() (Desnes Nunes) [RHEL-35002] {CVE-2024-26934} - usb: xhci: Add error handling in xhci_map_urb_for_dma (Desnes Nunes) [RHEL-34958] {CVE-2024-26964} - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (Ewan D. Milne) [RHEL-35076] {CVE-2024-26993} - xhci: handle isoc Babble and Buffer Overrun events properly (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - xhci: process isoc TD properly when there was a transaction error mid TD. (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - USB: core: Fix deadlock in port "disable" sysfs attribute (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - USB: core: Add hub_get() and hub_put() routines (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - netfilter: ipset: Missing gc cancellations fixed (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix performance regression in swap operation (Phil Sutter) [RHEL-30521] - netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test (Phil Sutter) [RHEL-30521] - x86/apic/x2apic: Fix a NULL pointer deref when handling a dying cpu (David Arcari) [RHEL-32516] - x86/coco: Disable 32-bit emulation by default on TDX and SEV (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Make IA32_EMULATION boot time configurable (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/elf: Make loading of 32bit processes depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Rename ignore_sysret() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/cpu: Don't write CSTAR MSR on Intel CPUs (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Introduce ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - [rt] build kernel-rt-4.18.0-552.2.1.rt7.343.el8_10 [RHEL-34640] - s390/ptrace: handle setting of fpc register correctly (Tobias Huschle) [RHEL-29106] {CVE-2023-52598} - net/smc: fix illegal rmb_desc access in SMC-D connection dump (Tobias Huschle) [RHEL-27746] {CVE-2024-26615} - wifi: mac80211: fix race condition on enabling fast-xmit (Jose Ignacio Tornos Martinez) [RHEL-31664] {CVE-2024-26779} - powerpc/fadump: make is_kdump_kernel() return false when fadump is active (Mamatha Inamdar) [RHEL-24401] - vmcore: remove dependency with is_kdump_kernel() for exporting vmcore (Mamatha Inamdar) [RHEL-24401] - mtd: require write permissions for locking and badblock ioctls (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - mtd: properly check all write ioctls for permissions (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - pid: take a reference when initializing `cad_pid` (Waiman Long) [RHEL-29420] {CVE-2021-47118} - i2c: i801: Don't generate an interrupt on bus reset (Prarit Bhargava) [RHEL-30325] {CVE-2021-47153} - RDMA/srpt: Do not register event handler until srpt device is fully setup (Kamal Heib) [RHEL-33224] {CVE-2024-26872} - ceph: switch to corrected encoding of max_xattr_size in mdsmap (Xiubo Li) [RHEL-26723] - ceph: switch to use cap_delay_lock for the unlink delay list (Xiubo Li) [RHEL-32870] - ceph: pass ino# instead of old_dentry if it's disconnected (Xiubo Li) [RHEL-32870] - fat: fix uninitialized field in nostale filehandles (Andrey Albershteyn) [RHEL-33186 RHEL-35108] {CVE-2024-26973} - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (Andrey Albershteyn) [RHEL-33186] {CVE-2024-26901} - idpf: limit the support to GCP only (Michal Schmidt) [RHEL-15652] - redhat/configs: enable CONFIG_IDPF (Michal Schmidt) [RHEL-15652] - idpf: remove the use of ETHTOOL_RING_USE_TCP_DATA_SPLIT (Michal Schmidt) [RHEL-15652] - idpf: workaround for unavailable skb page recycling (Michal Schmidt) [RHEL-15652] - idpf: always allocate a full page (Michal Schmidt) [RHEL-15652] - idpf: remove page pool stats code (Michal Schmidt) [RHEL-15652] - idpf: add minimal macros for __free(kfree) to work (Michal Schmidt) [RHEL-15652] - idpf: fixup include paths for RHEL 8 (Michal Schmidt) [RHEL-15652] - idpf: fix kernel panic on unknown packet types (Michal Schmidt) [RHEL-15652] - idpf: disable local BH when scheduling napi for marker packets (Michal Schmidt) [RHEL-15652] - idpf: remove dealloc vector msg err in idpf_intr_rel (Michal Schmidt) [RHEL-15652] - idpf: fix minor controlq issues (Michal Schmidt) [RHEL-15652] - idpf: prevent deinit uninitialized virtchnl core (Michal Schmidt) [RHEL-15652] - idpf: cleanup virtchnl cruft (Michal Schmidt) [RHEL-15652] - idpf: refactor idpf_recv_mb_msg (Michal Schmidt) [RHEL-15652] - idpf: add async_handler for MAC filter messages (Michal Schmidt) [RHEL-15652] - idpf: refactor remaining virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor queue related virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor vport virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: implement virtchnl transaction manager (Michal Schmidt) [RHEL-15652] - idpf: add idpf_virtchnl.h (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler padding in virtchnl2_ptype struct (Michal Schmidt) [RHEL-15652] - idpf: distinguish vports by the dev_port attribute (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler introduced padding in virtchnl2_rss_key struct (Michal Schmidt) [RHEL-15652] - idpf: fix corrupted frames and skb leaks in singleq mode (Michal Schmidt) [RHEL-15652] - idpf: refactor some missing field get/prep conversions (Michal Schmidt) [RHEL-15652] - idpf: add get/set for Ethtool's header split ringparam (Michal Schmidt) [RHEL-15652] - idpf: fix potential use-after-free in idpf_tso() (Michal Schmidt) [RHEL-15652] - idpf: cancel mailbox work in error path (Michal Schmidt) [RHEL-15652] - idpf: set scheduling mode for completion queue (Michal Schmidt) [RHEL-15652] - idpf: add SRIOV support and other ndo_ops (Michal Schmidt) [RHEL-15652] - idpf: add ethtool callbacks (Michal Schmidt) [RHEL-15652] - idpf: add singleq start_xmit and napi poll (Michal Schmidt) [RHEL-15652] - idpf: add RX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add TX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add splitq start_xmit (Michal Schmidt) [RHEL-15652] - idpf: initialize interrupts and enable vport (Michal Schmidt) [RHEL-15652] - idpf: configure resources for RX queues (Michal Schmidt) [RHEL-15652] - idpf: configure resources for TX queues (Michal Schmidt) [RHEL-15652] - idpf: add ptypes and MAC filter support (Michal Schmidt) [RHEL-15652] - idpf: add create vport and netdev configuration (Michal Schmidt) [RHEL-15652] - idpf: add core init and interrupt request (Michal Schmidt) [RHEL-15652] - idpf: add controlq init and reset checks (Michal Schmidt) [RHEL-15652] - idpf: add module register and probe functionality (Michal Schmidt) [RHEL-15652] - virtchnl: add virtchnl version 2 ops (Michal Schmidt) [RHEL-15652] - net: netdev_queue: netdev_txq_completed_mb(): fix wake condition (Michal Schmidt) [RHEL-15652] - net: piggy back on the memory barrier in bql when waking queues (Michal Schmidt) [RHEL-15652] - net: provide macros for commonly copied lockless queue stop/wake code (Michal Schmidt) [RHEL-15652] - [rt] build kernel-rt-4.18.0-552.1.1.rt7.342.el8_10 [RHEL-34640] - build: Update RTBZ for 8.10 z-stream builds (Denys Vlasenko) - redhat: set DIST to el8_10 and ZSTREAM to yes for 8.10 (Denys Vlasenko) - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (Prarit Bhargava) [RHEL-32590] {CVE-2021-47185} - net: mana: Fix Rx DMA datasize and skb_over_panic (Cathy Avery) [RHEL-32579] - RDMA/srpt: Support specifying the srpt_service_guid parameter (Kamal Heib) [RHEL-31710] {CVE-2024-26744} - RDMA/qedr: Fix qedr_create_user_qp error flow (Kamal Heib) [RHEL-31714] {CVE-2024-26743} - hwmon: (coretemp) Fix out-of-bounds memory access (David Arcari) [RHEL-31305] {CVE-2024-26664} - RDMA/irdma: Fix KASAN issue with tasklet (Kamal Heib) [RHEL-15776] - net: bridge: use DEV_STATS_INC() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: Fix unwanted sign extension in netdev_stats_to_stats64() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: add atomic_long_t to net_device_stats fields (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net/sched: act_ct: fix skb leak and crash on ooo frags (Xin Long) [RHEL-29467] {CVE-2023-52610} - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Jose Ignacio Tornos Martinez) [RHEL-28015] {CVE-2023-52528} - RDMA/core: Fix uninit-value access in ib_get_eth_speed() (Kamal Heib) [RHEL-30130] - RDMA/core: Get IB width and speed from netdev (Kamal Heib) [RHEL-30130] - cpufreq: intel_pstate: Add Emerald Rapids support in no-HWP mode (Prarit Bhargava) [RHEL-29444] - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add (Mamatha Inamdar) [RHEL-29118] {CVE-2023-52607} - powerpc/lib: Validate size for vector operations (Mamatha Inamdar) [RHEL-29114] {CVE-2023-52606} - usb: hub: Guard against accesses to uninitialized BOS descriptors (Desnes Nunes) [RHEL-28986] {CVE-2023-52477} - media: uvcvideo: Fix OOB read (Desnes Nunes) [RHEL-27940] {CVE-2023-52565} - media: pvrusb2: fix use after free on context disconnection (Desnes Nunes) [RHEL-26498] {CVE-2023-52445} - i2c: i801: Fix block process call transactions (Prarit Bhargava) [RHEL-26478] {CVE-2024-26593} - overlay: disable EVM (Coiby Xu) [RHEL-19863] - evm: add support to disable EVM on unsupported filesystems (Coiby Xu) [RHEL-19863] - evm: don't copy up 'security.evm' xattr (Coiby Xu) [RHEL-19863] - net: ena: Remove ena_select_queue (Kamal Heib) [RHEL-14286] - media: dvbdev: Fix memory leak in dvb_media_device_free() (Prarit Bhargava) [RHEL-27254] {CVE-2020-36777} - gfs2: Fix invalid metadata access in punch_hole (Andrew Price) [RHEL-28784] - i2c: Fix a potential use after free (Prarit Bhargava) [RHEL-26849] {CVE-2019-25162} - i2c: validate user data in compat ioctl (Prarit Bhargava) [RHEL-27022] {CVE-2021-46934} - platform/x86: think-lmi: Fix reference leak (Prarit Bhargava) [RHEL-28030] {CVE-2023-52520} - vhost: use kzalloc() instead of kmalloc() followed by memset() (Jon Maloy) [RHEL-21505] {CVE-2024-0340} - RDMA/siw: Fix connection failure handling (Kamal Heib) [RHEL-28042] {CVE-2023-52513} - vt: fix memory overlapping when deleting chars in the buffer (Waiman Long) [RHEL-27778 RHEL-27779] {CVE-2022-48627} - x86/fpu: Stop relying on userspace for info to fault in xsave buffer (Steve Best) [RHEL-26669] {CVE-2024-26603} - mptcp: fix double-free on socket dismantle (Davide Caratti) [RHEL-22773] {CVE-2024-26782} - crypto: akcipher - Disable signing and decryption (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: akcipher - default implementations for request callbacks (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: testmgr - split akcipher tests by a key type (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - workqueue: Warn when a rescuer could not be created (Waiman Long) [RHEL-22136] - RDMA/cma: Avoid GID lookups on iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/cma: Deduplicate error flow in cma_validate_port() (Benjamin Coddington) [RHEL-12456] - RDMA/core: Set gid_attr.ndev for iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/siw: Fabricate a GID on tun and loopback devices (Benjamin Coddington) [RHEL-12456] - eventpoll: fix missing wakeup for ovflist in ep_poll_callback (Luis Claudio R. Goncalves) [RHEL-23022] - [rt] build kernel-rt-4.18.0-552.rt7.341.el8 [RHEL-5332] - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248] - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248] - [rt] build kernel-rt-4.18.0-551.rt7.340.el8 [RHEL-5332] - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742} - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992] - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825} - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237] - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724} - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513} - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921] - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921] - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921] - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921] - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921] - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774] - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660] - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660] - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199] - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539} - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825} - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237] - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724} - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513} - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921] - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921] - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921] - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921] - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921] - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285} - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993} - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396] - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396] - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396] - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396] - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355] - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355] - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355] - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355] - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355] - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355] - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240} - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek) - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963] - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171] - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171] - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226] - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226] - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744] - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744] - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744] - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744] - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew) [RHEL-129945] - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774] - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660] - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660] - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199] - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539} - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825} - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237] - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724} - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513} - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921] - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921] - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921] - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921] - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921] - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301} - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933} - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051} - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449] - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096} - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285} - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993} - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396] - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396] - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396] - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396] - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355] - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355] - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355] - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355] - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355] - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355] - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240} - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek) - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963] - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171] - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171] - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226] - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226] - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744] - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744] - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744] - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744] - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew) [RHEL-129945] - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774] - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660] - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660] - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199] - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539} - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - Bluetooth: hci_event: call disconnect callback before deleting conn (CKI Backport Bot) [RHEL-137039] {CVE-2023-53673} - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CKI Backport Bot) [RHEL-134423] {CVE-2025-40277} - xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 (John J Coleman) [RHEL-111354] - xen: Fix x86 sched_clock() interface for xen (John J Coleman) [RHEL-111354] - x86/xen/time: Output xen sched_clock time from 0 (John J Coleman) [RHEL-111354] - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Olga Kornievskaia) [RHEL-132819] - vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139273] {CVE-2025-40248} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ignore ndlp rport mismatch in dev_loss_tmo callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Modify handling of ADISC based on ndlp state and RPI registration (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Delete NLP_TARGET_REMOVE flag due to obsolete usage (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo callback (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Check devloss callbk done flag for potential stale NDLP ptrs (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kref imbalance on fabric ndlps from dev_loss_tmo handler (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Update PRLO handling in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Add condition to delete ndlp object after sending BLS_RJT to an ABTS (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove NLP_RCV_PLOGI early return during RSCN processing for ndlps (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Allow lpfc_plogi_confirm_nport() logic to execute for Fabric nodes (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix list_entry null check warning in lpfc_cmpl_els_plogi() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix possible file string name overflow when updating firmware (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Validate ELS LS_ACC completion payload (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove extra ndlp kref decrement in FLOGI cmpl for loop topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Revise NPIV ELS unsol rcv cmpl logic to drop ndlp based on nlp_state (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix double free in lpfc_cmpl_els_logo_acc() caused by lpfc_nlp_not_used() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Move scsi_host_template outside dynamically allocated/freed phba (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fill in missing ndlp kref puts in error paths (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login (Ewan D. Milne) [RHEL-32324] - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301} - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933} - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051} - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449] - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096} - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285} - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993} - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396] - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396] - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396] - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396] - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355] - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355] - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355] - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355] - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355] - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355] - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240} - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek) - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963] - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171] - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171] - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226] - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226] - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744] - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744] - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744] - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744] - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew) [RHEL-129945] - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117] - [rt] build kernel-rt-4.18.0-552.rt7.341.el8 [RHEL-5332] - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248] - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248] - [rt] build kernel-rt-4.18.0-551.rt7.340.el8 [RHEL-5332] - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742} - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992] - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992] - [rt] build kernel-rt-4.18.0-550.rt7.339.el8 [RHEL-5332] - mm/sparsemem: fix race in accessing memory_section->usage (Waiman Long) [RHEL-28875 RHEL-28876] {CVE-2023-52489} - mm: use __pfn_to_section() instead of open coding it (Waiman Long) [RHEL-28875] {CVE-2023-52489} - [rt] build kernel-rt-4.18.0-549.rt7.338.el8 [RHEL-5332] - dm-integrity: align the outgoing bio in integrity_recheck (Benjamin Marzinski) [RHEL-29678] - dm-integrity: fix a memory leak when rechecking the data (Benjamin Marzinski) [RHEL-29678] - RDMA/mana_ib: Add CQ interrupt support for RAW QP (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: query device capabilities (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: register RDMA device with GDMA (Maxim Levitsky) [RHEL-23934] - net: mana: add msix index sharing between EQs (Maxim Levitsky) [RHEL-23934] - net: mana: Fix spelling mistake "enforecement" -> "enforcement" (Maxim Levitsky) [RHEL-23934] - net :mana :Add remaining GDMA stats for MANA to ethtool (Maxim Levitsky) [RHEL-23934] - net: mana: Fix oversized sge0 for GSO packets (Maxim Levitsky) [RHEL-23934] - net: mana: Fix TX CQE error handling (Maxim Levitsky) [RHEL-23934] - net: mana: Add gdma stats to ethtool output for mana (Maxim Levitsky) [RHEL-23934] - net: mana: Fix MANA VF unload when hardware is unresponsive (Maxim Levitsky) [RHEL-23934] - net: mana: Configure hwc timeout from hardware (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (Maxim Levitsky) [RHEL-23934] - [rt] build kernel-rt-4.18.0-548.rt7.337.el8 [RHEL-5332] - gitlab-ci: enable arm64/s390x/ppc64le debug builds (Michael Hofmann) - arm64: Add missing bits of AmpereOne Spectre-BHB mitigation (Mark Salter) [RHEL-29005] - [rt] enable CONFIG_DRM_MGAG200_IOBURST_WORKAROUND (Jocelyn Falempe) [RHEL-13214] - drm/mgag200: Add a workaround for low-latency (Jocelyn Falempe) [RHEL-13214] - [rt] build kernel-rt-4.18.0-547.rt7.336.el8 [RHEL-5332] - x86/efistub: Avoid placing the kernel below LOAD_PHYSICAL_ADDR (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Give up if memory attribute protocol returns an error (Lenny Szubowicz) [RHEL-2505] - x86/boot: Increase section and file alignment to 4k/512 (Lenny Szubowicz) [RHEL-2505] - x86/boot: Split off PE/COFF .data section (Lenny Szubowicz) [RHEL-2505] - x86/boot: Drop PE/COFF .reloc section (Lenny Szubowicz) [RHEL-2505] - x86/boot: Construct PE/COFF .text section from assembler (Lenny Szubowicz) [RHEL-2505] - x86/boot: Derive file size from _edata symbol (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed: Remove, discard, or assert for unwanted sections (Lenny Szubowicz) [RHEL-2505] - x86/boot: Check that there are no run-time relocations (Lenny Szubowicz) [RHEL-2505] - x86/boot: Discard .discard.unreachable for arch/x86/boot/compressed/vmlinux (Lenny Szubowicz) [RHEL-2505] - x86/boot: Define setup size in linker script (Lenny Szubowicz) [RHEL-2505] - x86/boot: Set EFI handover offset directly in header asm (Lenny Szubowicz) [RHEL-2505] - x86/boot: Drop references to startup_64 (Lenny Szubowicz) [RHEL-2505] - x86/boot: Drop redundant code setting the root device (Lenny Szubowicz) [RHEL-2505] - x86/build: Declutter the build output (Lenny Szubowicz) [RHEL-2505] - x86/boot: Omit compression buffer from PE/COFF image memory footprint (Lenny Szubowicz) [RHEL-2505] - x86/boot: Mark global variables as static (Lenny Szubowicz) [RHEL-2505] - efi/x86: Remove extra headroom for setup block (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove the 'bugger off' message (Lenny Szubowicz) [RHEL-2505] - x86/efi: Drop alignment flags from PE section headers (Lenny Szubowicz) [RHEL-2505] - efi: Put Linux specific magic number in the DOS header (Lenny Szubowicz) [RHEL-2505] - efi/x86: Fix the missing KASLR_FLAG bit in boot_params->hdr.loadflags (Lenny Szubowicz) [RHEL-2505] - efi/x86: Avoid physical KASLR on older Dell systems (Lenny Szubowicz) [RHEL-2505] - x86/boot: efistub: Assign global boot_params variable (Lenny Szubowicz) [RHEL-2505] - x86/boot: Rename conflicting 'boot_params' pointer to 'boot_params_ptr' (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Avoid legacy decompressor when doing EFI boot (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Perform SNP feature test while running in the firmware (Lenny Szubowicz) [RHEL-2505] - x86/sev: Do not try to parse for the CC blob on non-AMD hardware (Lenny Szubowicz) [RHEL-2505] - efi/libstub: Add limit argument to efi_random_alloc() (Lenny Szubowicz) [RHEL-2505] - arm64: efi: Limit allocations to 48-bit addressable physical region (Lenny Szubowicz) [RHEL-2505] - efi: libstub: use EFI_LOADER_CODE region when moving the kernel in memory (Lenny Szubowicz) [RHEL-2505] - arm64: efi: kaslr: Fix occasional random alloc (and boot) failure (Lenny Szubowicz) [RHEL-2505] - efi/libstub/random: Increase random alloc granularity (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Factor out kernel decompression and relocation (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Move global symbol references to C code (Lenny Szubowicz) [RHEL-2505] - decompress: Use 8 byte alignment (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Prefer EFI memory attributes protocol over DXE services (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Perform 4/5 level paging switch from the stub (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Merge trampoline cleanup with switching code (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Pass pgtable address to trampoline directly (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Only call the trampoline when changing paging levels (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Call trampoline directly from C code (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Avoid the need for a stack in the 32-bit trampoline (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Use standard calling convention for trampoline (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Call trampoline as a normal function (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Remove .bss/.pgtable from bzImage (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove run-time relocations from .head.text code (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Assign paging related global variables earlier (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Store boot_params pointer in callee save register (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Clear BSS in EFI handover protocol entrypoint (Lenny Szubowicz) [RHEL-2505] - x86/head_64: Store boot_params pointer in callee save register (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Don't rely on upper 32 bits of GPRs being preserved (Lenny Szubowicz) [RHEL-2505] - x86/head/64: Switch to KERNEL_CS as soon as new GDT is installed (Lenny Szubowicz) [RHEL-2505] - efi/libstub: Add memory attribute protocol definitions (Lenny Szubowicz) [RHEL-2505] - efi/x86: libstub: remove unused variable (Lenny Szubowicz) [RHEL-2505] - x86/boot: Robustify calling startup_{32,64}() from the decompressor code (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Simplify and clean up handover entry code (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Branch straight to kernel entry point from C code (Lenny Szubowicz) [RHEL-2505] - efi/x86: Avoid using code32_start (Lenny Szubowicz) [RHEL-2505] - efi/libstub/x86: Use Exit() boot service to exit the stub on errors (Lenny Szubowicz) [RHEL-2505] - efi: x86: Wipe setup_data on pure EFI boot (Lenny Szubowicz) [RHEL-2505] - efi: x86: Fix config name for setting the NX-compatibility flag in the PE header (Lenny Szubowicz) [RHEL-2505] - efi: x86: Set the NX-compatibility flag in the PE header (Lenny Szubowicz) [RHEL-2505] - efi/x86: Add kernel preferred address to PE header (Lenny Szubowicz) [RHEL-2505] - efi/x86: Use symbolic constants in PE header instead of bare numbers (Lenny Szubowicz) [RHEL-2505] - efi/x86: Drop redundant .bss section (Lenny Szubowicz) [RHEL-2505] - efi/x86: add headroom to decompressor BSS to account for setup block (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove run-time relocations from head_{32,64}.S (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed: Fix debug_puthex() parameter type (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Use 32-bit (zero-extended) MOV for z_output_len (Lenny Szubowicz) [RHEL-2505] - x86/boot: Use unsigned comparison for addresses (Lenny Szubowicz) [RHEL-2505] - x86/boot: Micro-optimize GDT loading instructions (Lenny Szubowicz) [RHEL-2505] - x86/boot: GDT limit value should be size - 1 (Lenny Szubowicz) [RHEL-2505] - efi/x86: Remove GDT setup from efi_main (Lenny Szubowicz) [RHEL-2505] - x86/boot: Clear direction and interrupt flags in startup_64 (Lenny Szubowicz) [RHEL-2505] - efi/x86: Don't depend on firmware GDT layout (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove KEEP_SEGMENTS support (Lenny Szubowicz) [RHEL-2505] - x86/boot: Handle malformed SRAT tables during early ACPI parsing (Lenny Szubowicz) [RHEL-2505] - efi/libstub/x86: Use mandatory 16-byte stack alignment in mixed mode (Lenny Szubowicz) [RHEL-2505] - efi/libstub/x86: Avoid globals to store context during mixed mode calls (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Disable paging at mixed mode entry (Lenny Szubowicz) [RHEL-2505] - x86: efi/random: Invoke EFI_RNG_PROTOCOL to seed the UEFI RNG table (Lenny Szubowicz) [RHEL-2505] - x86/asm: Make some functions local (Lenny Szubowicz) [RHEL-2505] - x86/boot: Annotate data appropriately (Lenny Szubowicz) [RHEL-2505] - x86/boot: Annotate local functions (Lenny Szubowicz) [RHEL-2505] - x86/asm: Make more symbols local (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Fix missing initialization in find_trampoline_placement() (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Fix boot on machines with broken E820 table (Lenny Szubowicz) [RHEL-2505] - x86, boot: Remove multiple copy of static function sanitize_boot_params() (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Remove unused variable (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Explain paging_prepare()'s return value (Lenny Szubowicz) [RHEL-2505] - x86/boot: Save several bytes in decompressor (Lenny Szubowicz) [RHEL-2505] - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (Audra Mitchell) [RHEL-20614] {CVE-2024-0841} - net/gve: update check for little-endianness in gve kconfig (Joshua Washington) [RHEL-29030] - [rt] build kernel-rt-4.18.0-546.rt7.335.el8 [RHEL-5332] - sched/membarrier: reduce the ability to hammer on sys_membarrier (Wander Lairson Costa) [RHEL-23430] {CVE-2024-26602} - NFS: Set the stable writes flag when initialising the super block (Benjamin Coddington) [RHEL-25266] - smb: client: fix OOB in receive_encrypted_standard() (Scott Mayhew) [RHEL-21685] {CVE-2024-0565} - scsi: core: Move scsi_host_busy() out of host lock if it is for per-command (Ming Lei) [RHEL-23942] - scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler (Ming Lei) [RHEL-23942] - gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump (Andrew Price) [RHEL-26501] {CVE-2023-52448} - smb: client: fix parsing of SMB3.1.1 POSIX create context (Paulo Alcantara) [RHEL-26241] {CVE-2023-52434} - smb: client: fix potential OOBs in smb2_parse_contexts() (Paulo Alcantara) [RHEL-26241] {CVE-2023-52434} - smb3: Replace smb2pdu 1-element arrays with flex-arrays (Jay Shin) [RHEL-22143] - cifs: Replace remaining 1-element arrays (Jay Shin) [RHEL-22143] - cifs: Convert struct fealist away from 1-element array (Jay Shin) [RHEL-22143] - cifs: remove unneeded 2bytes of padding from smb2 tree connect (Jay Shin) [RHEL-22143] - cifs: Replace zero-length arrays with flexible-array members (Jay Shin) [RHEL-22143] - cifs: Replace a couple of one-element arrays with flexible-array members (Jay Shin) [RHEL-22143] - cifs: fix FILE_BOTH_DIRECTORY_INFO definition (Jay Shin) [RHEL-22143] - nfsd: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - nfs: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - lockd: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - cifs: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - ceph: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - filelock: add a new locks_inode_context accessor function (Jeffrey Layton) [RHEL-27441] - dm-integrity, dm-verity: reduce stack usage for recheck (Benjamin Marzinski) [RHEL-27849] - dm-crypt: recheck the integrity tag after a failure (Benjamin Marzinski) [RHEL-27849] - dm-crypt: don't modify the data when using authenticated encryption (Benjamin Marzinski) [RHEL-27849] - dm-verity: recheck the hash after a failure (Benjamin Marzinski) [RHEL-27849] - dm-integrity: recheck the integrity tag after a failure (Benjamin Marzinski) [RHEL-27849] - [rt] build kernel-rt-4.18.0-545.rt7.334.el8 [RHEL-5332] - tracing/timerlat: Move hrtimer_init to timerlat_fd open() (John Kacur) [RHEL-26667] - tracing/perf: Fix double put of trace event when init fails (Michael Petlan) [RHEL-19537] - ipvlan: Add handling of NETDEV_UP events (Hangbin Liu) [RHEL-19098] - ceph: add ceph_cap_unlink_work to fire check_caps() immediately (Xiubo Li) [RHEL-21760] - ceph: always queue a writeback when revoking the Fb caps (Xiubo Li) [RHEL-21760] - ceph: always check dir caps asynchronously (Xiubo Li) [RHEL-21760] - nfs: fix redundant readdir request after get eof (Benjamin Coddington) [RHEL-7780] - NFSv4.1: fixup use EXCHGID4_FLAG_USE_PNFS_DS for DS server (Scott Mayhew) [RHEL-7994] - NFSv4.1: fix pnfs MDS=DS session trunking (Scott Mayhew) [RHEL-7994] - NFSv4.1: fix zero value filehandle in post open getattr (Scott Mayhew) [RHEL-7994] - NFSv4.1: use EXCHGID4_FLAG_USE_PNFS_DS for DS server (Scott Mayhew) [RHEL-7994] - x86/boot: Ignore NMIs during very early boot (Valentin Schneider) [RHEL-22749] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - vfs: use READ_ONCE() to access ->i_link (Jay Shin) [RHEL-141790] - fold generic_readlink() into its only caller (Jay Shin) [RHEL-141790] - fs/proc: fix uaf in proc_readdir_de() (Pavel Reichl) [RHEL-137093] {CVE-2025-40271} - Backport 'create an empty changelog file when changing its name' (Alexandra Hájková) - mptcp: fix race condition in mptcp_schedule_work() (Paolo Abeni) [RHEL-134443] {CVE-2025-40258} - mptcp: use mptcp_schedule_work instead of open-coding it (Paolo Abeni) [RHEL-134443] - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - tcp: minor optimization in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Kamal Heib) [RHEL-134347] {CVE-2025-38022} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - Bluetooth: hci_event: call disconnect callback before deleting conn (CKI Backport Bot) [RHEL-137039] {CVE-2023-53673} - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CKI Backport Bot) [RHEL-134423] {CVE-2025-40277} - xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 (John J Coleman) [RHEL-111354] - xen: Fix x86 sched_clock() interface for xen (John J Coleman) [RHEL-111354] - x86/xen/time: Output xen sched_clock time from 0 (John J Coleman) [RHEL-111354] - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Olga Kornievskaia) [RHEL-132819] - vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139273] {CVE-2025-40248} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ignore ndlp rport mismatch in dev_loss_tmo callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Modify handling of ADISC based on ndlp state and RPI registration (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Delete NLP_TARGET_REMOVE flag due to obsolete usage (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo callback (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Check devloss callbk done flag for potential stale NDLP ptrs (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kref imbalance on fabric ndlps from dev_loss_tmo handler (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Update PRLO handling in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Add condition to delete ndlp object after sending BLS_RJT to an ABTS (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove NLP_RCV_PLOGI early return during RSCN processing for ndlps (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Allow lpfc_plogi_confirm_nport() logic to execute for Fabric nodes (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix list_entry null check warning in lpfc_cmpl_els_plogi() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix possible file string name overflow when updating firmware (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Validate ELS LS_ACC completion payload (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove extra ndlp kref decrement in FLOGI cmpl for loop topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Revise NPIV ELS unsol rcv cmpl logic to drop ndlp based on nlp_state (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix double free in lpfc_cmpl_els_logo_acc() caused by lpfc_nlp_not_used() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Move scsi_host_template outside dynamically allocated/freed phba (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fill in missing ndlp kref puts in error paths (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login (Ewan D. Milne) [RHEL-32324] - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301} - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933} - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051} - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449] - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096} - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - vfs: use READ_ONCE() to access ->i_link (Jay Shin) [RHEL-141790] - fold generic_readlink() into its only caller (Jay Shin) [RHEL-141790] - fs/proc: fix uaf in proc_readdir_de() (Pavel Reichl) [RHEL-137093] {CVE-2025-40271} - Backport 'create an empty changelog file when changing its name' (Alexandra Hájková) - mptcp: fix race condition in mptcp_schedule_work() (Paolo Abeni) [RHEL-134443] {CVE-2025-40258} - mptcp: use mptcp_schedule_work instead of open-coding it (Paolo Abeni) [RHEL-134443] - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - tcp: minor optimization in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Kamal Heib) [RHEL-134347] {CVE-2025-38022} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - vfs: use READ_ONCE() to access ->i_link (Jay Shin) [RHEL-141790] - fold generic_readlink() into its only caller (Jay Shin) [RHEL-141790] - fs/proc: fix uaf in proc_readdir_de() (Pavel Reichl) [RHEL-137093] {CVE-2025-40271} - Backport 'create an empty changelog file when changing its name' (Alexandra Hájková) - mptcp: fix race condition in mptcp_schedule_work() (Paolo Abeni) [RHEL-134443] {CVE-2025-40258} - mptcp: use mptcp_schedule_work instead of open-coding it (Paolo Abeni) [RHEL-134443] - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - tcp: minor optimization in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Kamal Heib) [RHEL-134347] {CVE-2025-38022} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - autofs: use wake_up() instead of wake_up_interruptible(() (Ian Kent) [RHEL-143685] - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Ian Kent) [RHEL-143685] {CVE-2023-54134} - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141709] - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-136693] - audit: merge loops in __audit_inode_child() (Ricardo Robaina) [RHEL-140442] - bridge: mcast: Fix use-after-free during router port configuration (Mohammad Heib) [RHEL-138422] {CVE-2025-38248} - net/sched: Enforce that teql can only be used as root qdisc (CKI Backport Bot) [RHEL-146992] {CVE-2026-23074} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Marc Milgram) [RHEL-137838] {CVE-2025-38129} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143189] {CVE-2025-68800} - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126886] {CVE-2025-40064} - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147261] {CVE-2026-23097} - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-134673] - autofs: use wake_up() instead of wake_up_interruptible(() (Ian Kent) [RHEL-143685] - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Ian Kent) [RHEL-143685] {CVE-2023-54134} - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141709] - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-136693] - audit: merge loops in __audit_inode_child() (Ricardo Robaina) [RHEL-140442] - bridge: mcast: Fix use-after-free during router port configuration (Mohammad Heib) [RHEL-138422] {CVE-2025-38248} - net/sched: Enforce that teql can only be used as root qdisc (CKI Backport Bot) [RHEL-146992] {CVE-2026-23074} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Marc Milgram) [RHEL-137838] {CVE-2025-38129} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143189] {CVE-2025-68800} - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126886] {CVE-2025-40064} - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - macvlan: fix possible UAF in macvlan_forward_source() (Hangbin Liu) [RHEL-144120] {CVE-2026-23001} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-131922] - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount (Jocelyn Falempe) [RHEL-148636] - audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd references (Waiman Long) [RHEL-146026] - fs: Add a pool of extra fs->pwd references to fs_struct (Waiman Long) [RHEL-146026] - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143535] {CVE-2025-71085} - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147261] {CVE-2026-23097} - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-134673] - autofs: use wake_up() instead of wake_up_interruptible(() (Ian Kent) [RHEL-143685] - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Ian Kent) [RHEL-143685] {CVE-2023-54134} - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141709] - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-136693] - audit: merge loops in __audit_inode_child() (Ricardo Robaina) [RHEL-140442] - bridge: mcast: Fix use-after-free during router port configuration (Mohammad Heib) [RHEL-138422] {CVE-2025-38248} - net/sched: Enforce that teql can only be used as root qdisc (CKI Backport Bot) [RHEL-146992] {CVE-2026-23074} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Marc Milgram) [RHEL-137838] {CVE-2025-38129} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143189] {CVE-2025-68800} - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126886] {CVE-2025-40064} - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - x86/microcode/AMD: Revert "Backport AMD microcode commits for better microcode loading support" (Waiman Long) [RHEL-155860] - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150398] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150398] - tcp: fix forever orphan socket caused by tcp_abort (Paolo Abeni) [RHEL-146187] - xfs: fix minimum agno handling for xfs alloc modes in RHEL8 (Brian Foster) [RHEL-102464] - xfs: fix uninitialized use of flags variable in xfs_alloc_vextent() (Brian Foster) [RHEL-102464] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82523] - tcp: use this_cpu_read(*X) instead of *this_cpu_ptr(X) (Davide Caratti) [RHEL-82523] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150221] - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150221] {CVE-2026-23209} - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) [RHEL-96016] - s390/kexec: Emit an error message when cmdline is too long (Mete Durlu) [RHEL-144946] - s390/boot: Fix kernel size in bootparm area (Mete Durlu) [RHEL-144946] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-137123] - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-151614] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove useless transaction in evict_linked_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-151614] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-151614] - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146419] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146419] {CVE-2025-38323} - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136288] - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136288] - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136288] - scsi: st: Tighten the page format heuristics with MODE SELECT (John Meneghini) [RHEL-136288] - scsi: st: ERASE does not change tape location (John Meneghini) [RHEL-136288] - scsi: st: Fix array overflow in st_setup() (John Meneghini) [RHEL-136288] - scsi: st: Add sysfs file position_lost_in_reset (John Meneghini) [RHEL-136288] - scsi: st: Modify st.c to use the new scsi_error counters (John Meneghini) [RHEL-136288] - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (John Meneghini) [RHEL-136288] - scsi: st: Restore some drive settings after reset (John Meneghini) [RHEL-136288] - scsi: st: Fix input/output error on empty drive reset (John Meneghini) [RHEL-136288] - smb: client: handle lack of IPC in dfs_cache_refresh() (Paulo Alcantara) [RHEL-138235] - smb: client: allow parsing zero-length AV pairs (Paulo Alcantara) [RHEL-138235] - cifs: reduce warning log level for server not advertising interfaces (Paulo Alcantara) [RHEL-138235] - smb: client: Fix match_session bug preventing session reuse (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of kstrdup() in get_ses_refpath() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy when tree connecting to DFS interlink targets (Paulo Alcantara) [RHEL-138235] - smb: client: don't trust DFSREF_STORAGE_SERVER bit (Paulo Alcantara) [RHEL-138235] - smb: client: don't check for @leaf_fullpath in match_server() (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of TCP_Server_Info::refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: don't retry DFS targets on server shutdown (Paulo Alcantara) [RHEL-138235] - smb: client: fix return value of parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: optimize referral walk on failed link targets (Paulo Alcantara) [RHEL-138235] - smb: client: provide dns_resolve_{unc,name} helpers (Paulo Alcantara) [RHEL-138235] - smb: client: parse DNS domain name from domain= option (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS mount against old servers with NTLMSSP (Paulo Alcantara) [RHEL-138235] - smb: client: parse av pair type 4 in CHALLENGE_MESSAGE (Paulo Alcantara) [RHEL-138235] - smb: client: introduce av_for_each_entry() helper (Paulo Alcantara) [RHEL-138235] - smb: client: fix double free of TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-138235] {CVE-2025-21673} - smb: client: fix potential race in cifs_put_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy message when mounting shares (Paulo Alcantara) [RHEL-138235] - smb: client: don't try following DFS links in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow reconnect when sending ioctl (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of @nlsc param in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow more DFS referrals to be cached (Paulo Alcantara) [RHEL-138235] - smb: client: propagate error from cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS failover in multiuser mounts (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS interlink failover (Paulo Alcantara) [RHEL-138235] - smb: client: improve purging of cached referrals (Paulo Alcantara) [RHEL-138235] - smb: client: avoid unnecessary reconnects when refreshing referrals (Paulo Alcantara) [RHEL-138235] - smb: client: serialise cifs_construct_tcon() with cifs_mount_mutex (Paulo Alcantara) [RHEL-138235] - smb: client: handle DFS tcons in cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: refresh referral without acquiring refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: guarantee refcounted children from parent session (Paulo Alcantara) [RHEL-138235] {CVE-2024-35869} - smb: client: set correct id, uid and cruid for multiuser automounts (Paulo Alcantara) [RHEL-138235] {CVE-2024-26822} - cifs: change tcon status when need_reconnect is set on it (Paulo Alcantara) [RHEL-138235] - smb: client: fix potential NULL deref in parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: fix mount when dns_resolver key is not available (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs code dep in namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs naming in automount code (Paulo Alcantara) [RHEL-138235] - smb: client: rename cifs_dfs_ref.c to namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: ensure to try all targets when finding nested links (Paulo Alcantara) [RHEL-138235] - smb: client: introduce DFS_CACHE_TGT_LIST() (Paulo Alcantara) [RHEL-138235] - smb: client: fix null auth (Paulo Alcantara) [RHEL-138235] - smb: client: fix dfs link mount against w2k8 (Paulo Alcantara) [RHEL-138235] - cifs: fix charset issue in reconnection (Paulo Alcantara) [RHEL-138235] - smb: client: fix missed ses refcounting (Paulo Alcantara) [RHEL-138235] {CVE-2023-54076} - fs/nls: make load_nls() take a const parameter (Paulo Alcantara) [RHEL-138235] - smb: client: remove redundant pointer 'server' (Paulo Alcantara) [RHEL-138235] - smb: client: improve DFS mount check (Paulo Alcantara) [RHEL-138235] - smb: client: fix shared DFS root mounts with different prefixes (Paulo Alcantara) [RHEL-138235] - smb: client: fix parsing of source mount option (Paulo Alcantara) [RHEL-138235] - smb: client: fix warning in cifs_match_super() (Paulo Alcantara) [RHEL-138235] - cifs: fix max_credits implementation (Paulo Alcantara) [RHEL-138235] - cifs: fix sockaddr comparison in iface_cmp (Paulo Alcantara) [RHEL-138235] - cifs: fix status checks in cifs_tree_connect (Paulo Alcantara) [RHEL-138235] - cifs: fix smb1 mount regression (Paulo Alcantara) [RHEL-138235] - cifs: fix sharing of DFS connections (Paulo Alcantara) [RHEL-138235] - cifs: avoid potential races when handling multiple dfs tcons (Paulo Alcantara) [RHEL-138235] - cifs: protect access of TCP_Server_Info::{origin,leaf}_fullpath (Paulo Alcantara) [RHEL-138235] - cifs: avoid dup prefix path in dfs_get_automount_devname() (Paulo Alcantara) [RHEL-138235] - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL (Paulo Alcantara) [RHEL-138235] {CVE-2023-53246} - smb3: fix unusable share after force unmount failure (Paulo Alcantara) [RHEL-138235] - cifs: check only tcon status on tcon related functions (Paulo Alcantara) [RHEL-138235] - cifs: return DFS root session id in DebugData (Paulo Alcantara) [RHEL-138235] - cifs: fix use-after-free bug in refresh_cache_worker() (Paulo Alcantara) [RHEL-138235] {CVE-2023-53052} - cifs: set DFS root session in cifs_get_smb_ses() (Paulo Alcantara) [RHEL-138235] - cifs: remove unused function (Paulo Alcantara) [RHEL-138235] - cifs: remove duplicate code in __refresh_tcon() (Paulo Alcantara) [RHEL-138235] - cifs: remove redundant assignment to the variable match (Paulo Alcantara) [RHEL-138235] - cifs: use origin fullpath for automounts (Paulo Alcantara) [RHEL-138235] - cifs: fix source pathname comparison of dfs supers (Paulo Alcantara) [RHEL-138235] - cifs: fix confusing debug message (Paulo Alcantara) [RHEL-138235] - cifs: don't block in dfs_cache_noreq_update_tgthint() (Paulo Alcantara) [RHEL-138235] - cifs: refresh root referrals (Paulo Alcantara) [RHEL-138235] - cifs: fix refresh of cached referrals (Paulo Alcantara) [RHEL-138235] - cifs: share dfs connections and supers (Paulo Alcantara) [RHEL-138235] - cifs: split out ses and tcon retrieval from mount_get_conns() (Paulo Alcantara) [RHEL-138235] - cifs: set resolved ip in sockaddr (Paulo Alcantara) [RHEL-138235] - cifs: remove unused smb3_fs_context::mount_options (Paulo Alcantara) [RHEL-138235] - cifs: get rid of mount options string parsing (Paulo Alcantara) [RHEL-138235] - cifs: use fs_context for automounts (Paulo Alcantara) [RHEL-138235] - cifs: remove various function description warnings (Paulo Alcantara) [RHEL-138235] - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Select which microcode patch to load (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add more known models to entry sign checking (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Limit Entrysign signature checking to known generations (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use sha256() instead of init/update/final (Waiman Long) [RHEL-132479] - x86/microcode: Fix Entrysign revision check for Zen1/Naples (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Handle the case of no BIOS microcode (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add some forgotten models to the SHA check (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Load only SHA256-checksummed patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add get_patch_level() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Merge early_apply_microcode() into its single callsite (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Have __apply_microcode_amd() return bool (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Flush patch buffer mapping after application (Waiman Long) [RHEL-132479] - x86/mm: Carve out INVLPG inline asm for use by others (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Split load_microcode_amd() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Pay attention to the stepping dynamically (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix a -Wsometimes-uninitialized clang false positive (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use the family,model,stepping encoded in the patch ID (Waiman Long) [RHEL-132479] - x86/microcode/amd: Cache builtin microcode too (Waiman Long) [RHEL-132479] - x86/microcode/amd: Use correct per CPU ucode_cpu_info (Waiman Long) [RHEL-132479] - x86/microcode/amd: Remove X86_32 specific code in early_apply_microcode() & get_builtin_microcode() (Waiman Long) [RHEL-132479] - x86/microcode: Move core specific defines to local header (Waiman Long) [RHEL-132479] - x86/microcode/intel: Rename get_datasize() since its used externally (Waiman Long) [RHEL-132479] - x86/microcode: Make reload_early_microcode() static (Waiman Long) [RHEL-132479] - x86/microcode: Include vendor headers into microcode.h (Waiman Long) [RHEL-132479] - x86/microcode/intel: Move microcode functions out of cpu/intel.c (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Get rid of __find_equiv_id() (Waiman Long) [RHEL-132479] - x86/microcode: Add explicit CPU vendor dependency (Waiman Long) [RHEL-132479] - macvlan: fix possible UAF in macvlan_forward_source() (Hangbin Liu) [RHEL-144120] {CVE-2026-23001} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-131922] - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount (Jocelyn Falempe) [RHEL-148636] - audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd references (Waiman Long) [RHEL-146026] - fs: Add a pool of extra fs->pwd references to fs_struct (Waiman Long) [RHEL-146026] - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143535] {CVE-2025-71085} - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147261] {CVE-2026-23097} - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-134673] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930] - NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242] - pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242] - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242] - NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242] - NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242] - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242] - SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242] - NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242] - SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242] - SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242] - SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242] - SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242] - NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242] - NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419] - nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419] - pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419] - NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419] - NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419] - NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419] - NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419] - NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419] - NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419] - NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419] - NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419] - NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419] - nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419] - nfs: always check dreq->error after a commit (Mike Snitzer) [RHEL-156419] - nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419] - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231} - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942] - x86/microcode/AMD: Revert "Backport AMD microcode commits for better microcode loading support" (Waiman Long) [RHEL-155860] - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150398] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150398] - tcp: fix forever orphan socket caused by tcp_abort (Paolo Abeni) [RHEL-146187] - xfs: fix minimum agno handling for xfs alloc modes in RHEL8 (Brian Foster) [RHEL-102464] - xfs: fix uninitialized use of flags variable in xfs_alloc_vextent() (Brian Foster) [RHEL-102464] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82523] - tcp: use this_cpu_read(*X) instead of *this_cpu_ptr(X) (Davide Caratti) [RHEL-82523] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150221] - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150221] {CVE-2026-23209} - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) [RHEL-96016] - s390/kexec: Emit an error message when cmdline is too long (Mete Durlu) [RHEL-144946] - s390/boot: Fix kernel size in bootparm area (Mete Durlu) [RHEL-144946] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-137123] - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-151614] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove useless transaction in evict_linked_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-151614] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-151614] - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146419] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146419] {CVE-2025-38323} - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136288] - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136288] - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136288] - scsi: st: Tighten the page format heuristics with MODE SELECT (John Meneghini) [RHEL-136288] - scsi: st: ERASE does not change tape location (John Meneghini) [RHEL-136288] - scsi: st: Fix array overflow in st_setup() (John Meneghini) [RHEL-136288] - scsi: st: Add sysfs file position_lost_in_reset (John Meneghini) [RHEL-136288] - scsi: st: Modify st.c to use the new scsi_error counters (John Meneghini) [RHEL-136288] - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (John Meneghini) [RHEL-136288] - scsi: st: Restore some drive settings after reset (John Meneghini) [RHEL-136288] - scsi: st: Fix input/output error on empty drive reset (John Meneghini) [RHEL-136288] - smb: client: handle lack of IPC in dfs_cache_refresh() (Paulo Alcantara) [RHEL-138235] - smb: client: allow parsing zero-length AV pairs (Paulo Alcantara) [RHEL-138235] - cifs: reduce warning log level for server not advertising interfaces (Paulo Alcantara) [RHEL-138235] - smb: client: Fix match_session bug preventing session reuse (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of kstrdup() in get_ses_refpath() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy when tree connecting to DFS interlink targets (Paulo Alcantara) [RHEL-138235] - smb: client: don't trust DFSREF_STORAGE_SERVER bit (Paulo Alcantara) [RHEL-138235] - smb: client: don't check for @leaf_fullpath in match_server() (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of TCP_Server_Info::refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: don't retry DFS targets on server shutdown (Paulo Alcantara) [RHEL-138235] - smb: client: fix return value of parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: optimize referral walk on failed link targets (Paulo Alcantara) [RHEL-138235] - smb: client: provide dns_resolve_{unc,name} helpers (Paulo Alcantara) [RHEL-138235] - smb: client: parse DNS domain name from domain= option (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS mount against old servers with NTLMSSP (Paulo Alcantara) [RHEL-138235] - smb: client: parse av pair type 4 in CHALLENGE_MESSAGE (Paulo Alcantara) [RHEL-138235] - smb: client: introduce av_for_each_entry() helper (Paulo Alcantara) [RHEL-138235] - smb: client: fix double free of TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-138235] {CVE-2025-21673} - smb: client: fix potential race in cifs_put_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy message when mounting shares (Paulo Alcantara) [RHEL-138235] - smb: client: don't try following DFS links in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow reconnect when sending ioctl (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of @nlsc param in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow more DFS referrals to be cached (Paulo Alcantara) [RHEL-138235] - smb: client: propagate error from cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS failover in multiuser mounts (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS interlink failover (Paulo Alcantara) [RHEL-138235] - smb: client: improve purging of cached referrals (Paulo Alcantara) [RHEL-138235] - smb: client: avoid unnecessary reconnects when refreshing referrals (Paulo Alcantara) [RHEL-138235] - smb: client: serialise cifs_construct_tcon() with cifs_mount_mutex (Paulo Alcantara) [RHEL-138235] - smb: client: handle DFS tcons in cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: refresh referral without acquiring refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: guarantee refcounted children from parent session (Paulo Alcantara) [RHEL-138235] {CVE-2024-35869} - smb: client: set correct id, uid and cruid for multiuser automounts (Paulo Alcantara) [RHEL-138235] {CVE-2024-26822} - cifs: change tcon status when need_reconnect is set on it (Paulo Alcantara) [RHEL-138235] - smb: client: fix potential NULL deref in parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: fix mount when dns_resolver key is not available (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs code dep in namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs naming in automount code (Paulo Alcantara) [RHEL-138235] - smb: client: rename cifs_dfs_ref.c to namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: ensure to try all targets when finding nested links (Paulo Alcantara) [RHEL-138235] - smb: client: introduce DFS_CACHE_TGT_LIST() (Paulo Alcantara) [RHEL-138235] - smb: client: fix null auth (Paulo Alcantara) [RHEL-138235] - smb: client: fix dfs link mount against w2k8 (Paulo Alcantara) [RHEL-138235] - cifs: fix charset issue in reconnection (Paulo Alcantara) [RHEL-138235] - smb: client: fix missed ses refcounting (Paulo Alcantara) [RHEL-138235] {CVE-2023-54076} - fs/nls: make load_nls() take a const parameter (Paulo Alcantara) [RHEL-138235] - smb: client: remove redundant pointer 'server' (Paulo Alcantara) [RHEL-138235] - smb: client: improve DFS mount check (Paulo Alcantara) [RHEL-138235] - smb: client: fix shared DFS root mounts with different prefixes (Paulo Alcantara) [RHEL-138235] - smb: client: fix parsing of source mount option (Paulo Alcantara) [RHEL-138235] - smb: client: fix warning in cifs_match_super() (Paulo Alcantara) [RHEL-138235] - cifs: fix max_credits implementation (Paulo Alcantara) [RHEL-138235] - cifs: fix sockaddr comparison in iface_cmp (Paulo Alcantara) [RHEL-138235] - cifs: fix status checks in cifs_tree_connect (Paulo Alcantara) [RHEL-138235] - cifs: fix smb1 mount regression (Paulo Alcantara) [RHEL-138235] - cifs: fix sharing of DFS connections (Paulo Alcantara) [RHEL-138235] - cifs: avoid potential races when handling multiple dfs tcons (Paulo Alcantara) [RHEL-138235] - cifs: protect access of TCP_Server_Info::{origin,leaf}_fullpath (Paulo Alcantara) [RHEL-138235] - cifs: avoid dup prefix path in dfs_get_automount_devname() (Paulo Alcantara) [RHEL-138235] - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL (Paulo Alcantara) [RHEL-138235] {CVE-2023-53246} - smb3: fix unusable share after force unmount failure (Paulo Alcantara) [RHEL-138235] - cifs: check only tcon status on tcon related functions (Paulo Alcantara) [RHEL-138235] - cifs: return DFS root session id in DebugData (Paulo Alcantara) [RHEL-138235] - cifs: fix use-after-free bug in refresh_cache_worker() (Paulo Alcantara) [RHEL-138235] {CVE-2023-53052} - cifs: set DFS root session in cifs_get_smb_ses() (Paulo Alcantara) [RHEL-138235] - cifs: remove unused function (Paulo Alcantara) [RHEL-138235] - cifs: remove duplicate code in __refresh_tcon() (Paulo Alcantara) [RHEL-138235] - cifs: remove redundant assignment to the variable match (Paulo Alcantara) [RHEL-138235] - cifs: use origin fullpath for automounts (Paulo Alcantara) [RHEL-138235] - cifs: fix source pathname comparison of dfs supers (Paulo Alcantara) [RHEL-138235] - cifs: fix confusing debug message (Paulo Alcantara) [RHEL-138235] - cifs: don't block in dfs_cache_noreq_update_tgthint() (Paulo Alcantara) [RHEL-138235] - cifs: refresh root referrals (Paulo Alcantara) [RHEL-138235] - cifs: fix refresh of cached referrals (Paulo Alcantara) [RHEL-138235] - cifs: share dfs connections and supers (Paulo Alcantara) [RHEL-138235] - cifs: split out ses and tcon retrieval from mount_get_conns() (Paulo Alcantara) [RHEL-138235] - cifs: set resolved ip in sockaddr (Paulo Alcantara) [RHEL-138235] - cifs: remove unused smb3_fs_context::mount_options (Paulo Alcantara) [RHEL-138235] - cifs: get rid of mount options string parsing (Paulo Alcantara) [RHEL-138235] - cifs: use fs_context for automounts (Paulo Alcantara) [RHEL-138235] - cifs: remove various function description warnings (Paulo Alcantara) [RHEL-138235] - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Select which microcode patch to load (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add more known models to entry sign checking (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Limit Entrysign signature checking to known generations (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use sha256() instead of init/update/final (Waiman Long) [RHEL-132479] - x86/microcode: Fix Entrysign revision check for Zen1/Naples (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Handle the case of no BIOS microcode (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add some forgotten models to the SHA check (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Load only SHA256-checksummed patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add get_patch_level() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Merge early_apply_microcode() into its single callsite (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Have __apply_microcode_amd() return bool (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Flush patch buffer mapping after application (Waiman Long) [RHEL-132479] - x86/mm: Carve out INVLPG inline asm for use by others (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Split load_microcode_amd() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Pay attention to the stepping dynamically (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix a -Wsometimes-uninitialized clang false positive (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use the family,model,stepping encoded in the patch ID (Waiman Long) [RHEL-132479] - x86/microcode/amd: Cache builtin microcode too (Waiman Long) [RHEL-132479] - x86/microcode/amd: Use correct per CPU ucode_cpu_info (Waiman Long) [RHEL-132479] - x86/microcode/amd: Remove X86_32 specific code in early_apply_microcode() & get_builtin_microcode() (Waiman Long) [RHEL-132479] - x86/microcode: Move core specific defines to local header (Waiman Long) [RHEL-132479] - x86/microcode/intel: Rename get_datasize() since its used externally (Waiman Long) [RHEL-132479] - x86/microcode: Make reload_early_microcode() static (Waiman Long) [RHEL-132479] - x86/microcode: Include vendor headers into microcode.h (Waiman Long) [RHEL-132479] - x86/microcode/intel: Move microcode functions out of cpu/intel.c (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Get rid of __find_equiv_id() (Waiman Long) [RHEL-132479] - x86/microcode: Add explicit CPU vendor dependency (Waiman Long) [RHEL-132479] - macvlan: fix possible UAF in macvlan_forward_source() (Hangbin Liu) [RHEL-144120] {CVE-2026-23001} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-131922] - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount (Jocelyn Falempe) [RHEL-148636] - audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd references (Waiman Long) [RHEL-146026] - fs: Add a pool of extra fs->pwd references to fs_struct (Waiman Long) [RHEL-146026] - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143535] {CVE-2025-71085} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930] - NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242] - pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242] - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242] - NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242] - NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242] - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242] - SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242] - NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242] - SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242] - SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242] - SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242] - SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242] - NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242] - NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419] - nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419] - pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419] - NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419] - NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419] - NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419] - NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419] - NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419] - NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419] - NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419] - NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419] - NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419] - nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419] - nfs: always check dreq->error after a commit (Mike Snitzer) [RHEL-156419] - nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419] - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231} - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942] - x86/microcode/AMD: Revert "Backport AMD microcode commits for better microcode loading support" (Waiman Long) [RHEL-155860] - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150398] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150398] - tcp: fix forever orphan socket caused by tcp_abort (Paolo Abeni) [RHEL-146187] - xfs: fix minimum agno handling for xfs alloc modes in RHEL8 (Brian Foster) [RHEL-102464] - xfs: fix uninitialized use of flags variable in xfs_alloc_vextent() (Brian Foster) [RHEL-102464] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82523] - tcp: use this_cpu_read(*X) instead of *this_cpu_ptr(X) (Davide Caratti) [RHEL-82523] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150221] - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150221] {CVE-2026-23209} - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) [RHEL-96016] - s390/kexec: Emit an error message when cmdline is too long (Mete Durlu) [RHEL-144946] - s390/boot: Fix kernel size in bootparm area (Mete Durlu) [RHEL-144946] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-137123] - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-151614] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove useless transaction in evict_linked_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-151614] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-151614] - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146419] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146419] {CVE-2025-38323} - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136288] - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136288] - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136288] - scsi: st: Tighten the page format heuristics with MODE SELECT (John Meneghini) [RHEL-136288] - scsi: st: ERASE does not change tape location (John Meneghini) [RHEL-136288] - scsi: st: Fix array overflow in st_setup() (John Meneghini) [RHEL-136288] - scsi: st: Add sysfs file position_lost_in_reset (John Meneghini) [RHEL-136288] - scsi: st: Modify st.c to use the new scsi_error counters (John Meneghini) [RHEL-136288] - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (John Meneghini) [RHEL-136288] - scsi: st: Restore some drive settings after reset (John Meneghini) [RHEL-136288] - scsi: st: Fix input/output error on empty drive reset (John Meneghini) [RHEL-136288] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930] - NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242] - pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242] - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242] - NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242] - NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242] - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242] - SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242] - NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242] - SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242] - SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242] - SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242] - SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242] - NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242] - NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419] - nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419] - pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419] - NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419] - NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419] - NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419] - NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419] - NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419] - NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419] - NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419] - NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419] - NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419] - nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419] - nfs: always check dreq->error after a commit (Mike Snitzer) [RHEL-156419] - nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419] - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231} - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942] - xfrm: esp: avoid in-place decrypt on shared skb frags - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772] - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772] - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772] - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772] - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772] - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772] - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709} - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815] - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815] - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815] - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190} - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408} - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684} - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032] - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032] - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032] - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032] - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032] - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032] - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032] - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032] - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032] - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183} - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219] - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219] - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219] - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219] - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219] - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219] - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219] - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347} - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243} - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890] - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890] - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890] - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890] - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890] - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890] - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890] - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613} - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961] - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858} - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392} - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781} - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990} - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772] - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772] - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772] - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772] - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772] - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772] - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709} - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815] - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815] - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815] - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190} - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408} - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684} - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032] - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032] - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032] - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032] - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032] - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032] - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032] - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032] - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032] - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183} - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219] - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219] - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219] - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219] - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219] - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219] - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219] - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347} - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243} - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890] - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890] - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890] - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890] - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890] - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890] - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890] - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613} - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961] - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858} - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392} - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781} - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990} - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772] - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772] - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772] - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772] - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772] - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772] - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709} - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815] - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815] - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815] - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190} - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408} - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684} - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032] - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032] - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032] - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032] - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032] - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032] - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032] - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032] - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032] - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183} - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219] - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219] - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219] - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219] - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219] - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219] - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219] - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347} - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243} - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890] - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890] - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890] - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890] - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890] - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890] - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890] - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613} - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961] - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858} - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392} - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781} - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - [rt] build kernel-rt-4.18.0-553.16.1.rt7.357.el8_10 [RHEL-44553] - x86/bhi: Fix incorrect CLEAR_BRANCH_HISTORY position in entry_INT80_compat (Waiman Long) [RHEL-50648] - [rt] build kernel-rt-4.18.0-553.15.1.rt7.356.el8_10 [RHEL-44553] - Revert "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-44613] - ionic: fix use after netif_napi_del() (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - ionic: clean interrupt before enabling queue to avoid credit race (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change (CKI Backport Bot) [RHEL-49321] {CVE-2021-47624} - xhci: Handle TD clearing for multiple streams case (CKI Backport Bot) [RHEL-47882] {CVE-2024-40927} - net: openvswitch: Fix Use-After-Free in ovs_ct_exit (cki-backport-bot) [RHEL-36362] {CVE-2024-27395} - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: fix vlan use-after-free (cki-backport-bot) [RHEL-43721] {CVE-2024-36979} - irqchip/gic-v3-its: Prevent double free on error (Charles Mirabile) [RHEL-37022] {CVE-2024-35847} - irqchip/gic-v3-its: Fix potential VPE leak on error (Charles Mirabile) [RHEL-37744] {CVE-2021-47373} - i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() (Charles Mirabile) [RHEL-34735] {CVE-2022-48632} - iommu/dma: fix zeroing of bounce buffer padding used by untrusted devices (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: remove alloc_size argument to swiotlb_tbl_map_single() (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: fix swiotlb_bounce() to do partial sync's correctly (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Reinstate page-alignment for mappings >= PAGE_SIZE (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix alignment checks when both allocation and DMA masks are present (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix double-allocation of slots due to broken alignment handling (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (cki-backport-bot) [RHEL-44441] {CVE-2024-31076} - [rt] build kernel-rt-4.18.0-553.14.1.rt7.355.el8_10 [RHEL-44553] - s390/qeth: Fix kernel panic after setting hsuid (Mete Durlu) [RHEL-49754] - perf/core: Protect event sibling list locking against interrupt inversion (Daniel Vacek) [RHEL-31798] - vt: fix unicode buffer corruption when deleting characters (Steve Best) [RHEL-36936] {CVE-2024-35823} - cifs: translate network errors on send to -ECONNABORTED (Paulo Alcantara) [RHEL-36754] - xfs: don't block in busy flushing when freeing extents (Brian Foster) [RHEL-7984] - xfs: allow extent free intents to be retried (Brian Foster) [RHEL-7984] - xfs: pass alloc flags through to xfs_extent_busy_flush() (Brian Foster) [RHEL-7984] - xfs: use deferred frees for btree block freeing (Brian Foster) [RHEL-7984] - xfs: fix bounds check in xfs_defer_agfl_block() (Brian Foster) [RHEL-7984] - xfs: validate block number being freed before adding to xefi (Brian Foster) [RHEL-7984] - xfs: rename xfs_bmap_add_free to xfs_free_extent_later (Brian Foster) [RHEL-7984] - usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (Desnes Nunes) [RHEL-36803] {CVE-2024-35790} - stm class: Fix a double free in stm_register_device() (Steve Best) [RHEL-44514] {CVE-2024-38627} - s390/qeth: Fix potential loss of L3-IP@ in case of network issues (Mete Durlu) [RHEL-49755] - tls: fix missing memory barrier in tls_init (cki-backport-bot) [RHEL-44471] {CVE-2024-36489} - xfs: fix log recovery buffer allocation for the legacy h_size fixup (Bill O'Donnell) [RHEL-46473] {CVE-2024-39472} - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: use __for_each_thread() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - exit: Use the correct exit_code in /proc/<pid>/stat (Brian Foster) [RHEL-31562] {CVE-2024-26686} - scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool (Ewan D. Milne) [RHEL-38283] {CVE-2023-52811} - scsi: qla2xxx: Fix double free of fcport (Ewan D. Milne) [RHEL-39549] {CVE-2024-26929} - scsi: qla2xxx: Fix double free of the ha->vp_map pointer (Ewan D. Milne) [RHEL-39549] {CVE-2024-26930} - scsi: qla2xxx: Fix command flush on cable pull (Ewan D. Milne) [RHEL-39549] {CVE-2024-26931} - [rt] build kernel-rt-4.18.0-553.13.1.rt7.354.el8_10 [RHEL-44553] - redhat: remove handling of deleted rhdocs/ directory from genspec.sh (Denys Vlasenko) - x86/bugs: Fix BHI retpoline check (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI handling of RRSBA (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr' (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI documentation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix return type of spectre_bhi_state() (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Make CONFIG_SPECTRE_BHI_ON the default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Mitigate KVM by default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add BHI mitigation knob (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Enumerate Branch History Injection (BHI) bug (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Define SPEC_CTRL_BHI_DIS_S (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add support for clearing branch history at syscall entry (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file (Waiman Long) [RHEL-28202] - perf/x86/amd/lbr: Use freeze based on availability (Waiman Long) [RHEL-28202] - Documentation/kernel-parameters: Add spec_rstack_overflow to mitigations=off (Waiman Long) [RHEL-28202] - KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace (Waiman Long) [RHEL-28202] - x86/bugs: Reset speculation control settings on init (Waiman Long) [RHEL-28202] - KVM: x86: Update KVM-only leaf handling to allow for 100% KVM-only leafs (Waiman Long) [RHEL-28202] - KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest (Waiman Long) [RHEL-28202] - mptcp: ensure snd_nxt is properly initialized on connect (Davide Caratti) [RHEL-39865] {CVE-2024-36889} - powerpc/pseries: Enforce hcall result buffer validity and size (Mamatha Inamdar) [RHEL-48291] {CVE-2024-40974} - wifi: mac80211: fix potential key use-after-free (Jose Ignacio Tornos Martinez) [RHEL-28007] {CVE-2023-52530} - cppc_cpufreq: Fix possible null pointer dereference (Mark Langsdorf) [RHEL-44137] {CVE-2024-38573} - net/sched: act_mirred: use the backlog for mirred ingress (Davide Caratti) [RHEL-31718] {CVE-2024-26740} - vfio/pci: Lock external INTx masking ops (Alex Williamson) [RHEL-31922] {CVE-2024-26810} - net: sched: sch_multiq: fix possible OOB write in multiq_tune() (Davide Caratti) [RHEL-43464] {CVE-2024-36978} - tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized (Guillaume Nault) [RHEL-37850] {CVE-2021-47304} - pstore/ram: Fix crash when setting number of cpus to an odd number (Lenny Szubowicz) [RHEL-29471] {CVE-2023-52619} - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node (Jocelyn Falempe) [RHEL-37101] {CVE-2023-52662} - drm/vmwgfx: Fix the lifetime of the bo cursor memory (Jocelyn Falempe) [RHEL-36962] {CVE-2024-35810} - drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed (Jocelyn Falempe) [RHEL-34987] {CVE-2024-26940} - drm/vmwgfx: Unmap the surface before resetting it on a plane state (Jocelyn Falempe) [RHEL-35217] {CVE-2023-52648} - drm/vmwgfx: Fix invalid reads in fence signaled events (Jocelyn Falempe) [RHEL-40010] {CVE-2024-36960} - block: Fix wrong offset in bio_truncate() (Ming Lei) [RHEL-43782] {CVE-2022-48747} - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CKI Backport Bot) [RHEL-46913] {CVE-2024-39487} - net: fix __dst_negative_advice() race (Xin Long) [RHEL-41183] {CVE-2024-36971} - igc: avoid returning frame twice in XDP_REDIRECT (Corinna Vinschen) [RHEL-33264] {CVE-2024-26853} - mac802154: fix llsec key resources release in mac802154_llsec_key_del (Steve Best) [RHEL-34967] {CVE-2024-26961} - cpufreq: exit() callback is optional (Mark Langsdorf) [RHEL-43840] {CVE-2024-38615} - cifs: prevent infinite recursion in CIFSGetDFSRefer() (Paulo Alcantara) [RHEL-34672] - cifs: lock chan_lock outside match_session (Paulo Alcantara) [RHEL-34672] - smb3: workaround negprot bug in some Samba servers (Paulo Alcantara) [RHEL-34672] - smb3: use netname when available on secondary channels (Paulo Alcantara) [RHEL-34672] - smb3: fix empty netname context on secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: populate empty hostnames for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: always iterate smb sessions using primary channel (Paulo Alcantara) [RHEL-34672] - cifs: Fix connections leak when tlink setup failed (Paulo Alcantara) [RHEL-34672] - cifs: Fix memory leak when build ntlmssp negotiate blob failed (Paulo Alcantara) [RHEL-34672] - cifs: always initialize struct msghdr smb_msg completely (Paulo Alcantara) [RHEL-34672] - cifs: don't send down the destination address to sendmsg for a SOCK_STREAM (Paulo Alcantara) [RHEL-34672] - cifs: revalidate mapping when doing direct writes (Paulo Alcantara) [RHEL-34672] - cifs: skip extra NULL byte in filenames (Paulo Alcantara) [RHEL-34672] - cifs: list_for_each() -> list_for_each_entry() (Paulo Alcantara) [RHEL-34672] - smb2: small refactor in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - cifs: Fix crash on unload of cifs_arc4.ko (Paulo Alcantara) [RHEL-34672] - cifs: remove check of list iterator against head past the loop body (Paulo Alcantara) [RHEL-34672] - cifs: fix reconnect on smb3 mount types (Paulo Alcantara) [RHEL-34672] - cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (Paulo Alcantara) [RHEL-34672] - cifs: skip trailing separators of prefix paths (Paulo Alcantara) [RHEL-34672] - cifs: fix ntlmssp on old servers (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL ptr dereference in refresh_mounts() (Paulo Alcantara) [RHEL-34672] - cifs: do not skip link targets when an I/O fails (Paulo Alcantara) [RHEL-34672] - cifs: fix confusing unneeded warning message on smb2.1 and earlier (Paulo Alcantara) [RHEL-34672] - smb3: fix snapshot mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix workstation_name for multiuser mounts (Paulo Alcantara) [RHEL-34672] - cifs: alloc_path_with_tree_prefix: do not append sep. if the path is empty (Paulo Alcantara) [RHEL-34672] - cifs: free ntlmsspblob allocated in negotiate (Paulo Alcantara) [RHEL-34672] - cifs: avoid use of dstaddr as key for fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: add server conn_id to fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: fix missed refcounting of ipc tcon (Paulo Alcantara) [RHEL-34672] - smb2: clarify rc initialization in smb2_reconnect (Paulo Alcantara) [RHEL-34672] - cifs: populate server_hostname for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should be set on new server (Paulo Alcantara) [RHEL-34672] - cifs: introduce cifs_ses_mark_for_reconnect() helper (Paulo Alcantara) [RHEL-34672] - cifs: protect srv_count with cifs_tcp_ses_lock (Paulo Alcantara) [RHEL-34672] - cifs: move debug print out of spinlock (Paulo Alcantara) [RHEL-34672] - cifs: do not duplicate fscache cookie for secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: connect individual channel servers to primary channel server (Paulo Alcantara) [RHEL-34672] - cifs: protect session channel fields with chan_lock (Paulo Alcantara) [RHEL-34672] - cifs: do not negotiate session if session already exists (Paulo Alcantara) [RHEL-34672] - smb3: do not setup the fscache_super_cookie until fsinfo initialized (Paulo Alcantara) [RHEL-34672] - cifs: fix potential use-after-free bugs (Paulo Alcantara) [RHEL-34672] - cifs: release lock earlier in dequeue_mid error case (Paulo Alcantara) [RHEL-34672] - smb3: remove trivial dfs compile warning (Paulo Alcantara) [RHEL-34672] - cifs: support nested dfs links over reconnect (Paulo Alcantara) [RHEL-34672] - cifs: for compound requests, use open handle if possible (Paulo Alcantara) [RHEL-34672] - cifs: split out dfs code from cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant (Paulo Alcantara) [RHEL-34672] - cifs: introduce new helper for cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: fix print of hdr_flags in dfscache_proc_show() (Paulo Alcantara) [RHEL-34672] - cifs: send workstation name during ntlmssp session setup (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should not share socket with future sessions (Paulo Alcantara) [RHEL-34672] - smb3: add dynamic trace points for socket connection (Paulo Alcantara) [RHEL-34672] - cifs: Move SMB2_Create definitions to the shared area (Paulo Alcantara) [RHEL-34672] - cifs: Move more definitions into the shared area (Paulo Alcantara) [RHEL-34672] - cifs: move NEGOTIATE_PROTOCOL definitions out into the common area (Paulo Alcantara) [RHEL-34672] - cifs: Create a new shared file holding smb2 pdu definitions (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect check for null pointer in header_assemble (Paulo Alcantara) [RHEL-34672] - smb3: correct server pointer dereferencing check to be more consistent (Paulo Alcantara) [RHEL-34672] - cifs: Deal with some warnings from W=1 (Paulo Alcantara) [RHEL-34672] - cifs: fix a sign extension bug (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect kernel doc comments (Paulo Alcantara) [RHEL-34672] - cifs: remove pathname for file from SPDX header (Paulo Alcantara) [RHEL-34672] - cifs: move SMB FSCTL definitions to common code (Paulo Alcantara) [RHEL-34672] - cifs: rename cifs_common to smbfs_common (Paulo Alcantara) [RHEL-34672] - cifs: update FSCTL definitions (Paulo Alcantara) [RHEL-34672] - cifs: cifs_md4 convert to SPDX identifier (Paulo Alcantara) [RHEL-34672] - cifs: create a MD4 module and switch cifs.ko to use it (Paulo Alcantara) [RHEL-34672] - cifs: fork arc4 and create a separate module for it for cifs and other users (Paulo Alcantara) [RHEL-34672] - smb3: fix posix extensions mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix wrong release in sess_alloc_buffer() failed path (Paulo Alcantara) [RHEL-34672] - CIFS: Fix a potencially linear read overflow (Paulo Alcantara) [RHEL-34672] - cifs: use the correct max-length for dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: create sd context must be a multiple of 8 (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp sessions of dfs connections (Paulo Alcantara) [RHEL-34672] - cifs: added WARN_ON for all the count decrements (Paulo Alcantara) [RHEL-34672] - cifs: fix missing null session check in mount (Paulo Alcantara) [RHEL-34672] - cifs: handle reconnect of tcon when there is no cached dfs referral (Paulo Alcantara) [RHEL-34672] - cifs: fix the out of range assignment to bit fields in parse_server_interfaces (Paulo Alcantara) [RHEL-34672] - smb3: fix typo in header file (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: Add support for negotiating signing algorithm (Paulo Alcantara) [RHEL-34672] - cifs: prevent NULL deref in cifs_compose_mount_options() (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL dereference in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - smbdirect: missing rc checks while waiting for rdma events (Paulo Alcantara) [RHEL-34672] - cifs: Avoid field over-reading memcpy() (Paulo Alcantara) [RHEL-34672] - smb311: remove dead code for non compounded posix query info (Paulo Alcantara) [RHEL-34672] - cifs: fix SMB1 error path in cifs_get_file_info_unix (Paulo Alcantara) [RHEL-34672] - smb3: fix uninitialized value for port in witness protocol move (Paulo Alcantara) [RHEL-34672] - cifs: fix unneeded null check (Paulo Alcantara) [RHEL-34672] - cifs: use SPDX-Licence-Identifier (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in cifs_debug.c (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in smb2misc.c (Paulo Alcantara) [RHEL-34672] - cifs: missed ref-counting smb session in find (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp servers with dfs mounts (Paulo Alcantara) [RHEL-34672] - cifs: set a minimum of 2 minutes for refreshing dfs cache (Paulo Alcantara) [RHEL-34672] - cifs: Remove unused inline function is_sysvol_or_netlogon() (Paulo Alcantara) [RHEL-34672] - cifs: remove duplicated prototype (Paulo Alcantara) [RHEL-34672] - cifs: fix ipv6 formating in cifs_ses_add_channel (Paulo Alcantara) [RHEL-34672] - cifs: fix string declarations and assignments in tracepoints (Paulo Alcantara) [RHEL-34672] - cifs: fix memory leak in smb2_copychunk_range (Paulo Alcantara) [RHEL-34672] - SMB3: incorrect file id in requests compounded with open (Paulo Alcantara) [RHEL-34672] - smb3: if max_channels set to more than one channel request multichannel (Paulo Alcantara) [RHEL-34672] - smb3: do not attempt multichannel to server which does not support it (Paulo Alcantara) [RHEL-34672] - smb3: when mounting with multichannel include it in requested capabilities (Paulo Alcantara) [RHEL-34672] - cifs: simplify SWN code with dummy funcs instead of ifdefs (Paulo Alcantara) [RHEL-34672] - cifs: log mount errors using cifs_errorf() (Paulo Alcantara) [RHEL-34672] - cifs: switch build_path_from_dentry() to using dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: fix out-of-bound memory access when calling smb3_notify() at mount point (Paulo Alcantara) [RHEL-34672] - cifs: allocate buffer in the caller of build_path_from_dentry() (Paulo Alcantara) [RHEL-34672] - cifs: make build_path_from_dentry() return const char * (Paulo Alcantara) [RHEL-34672] - cifs: remove old dead code (Paulo Alcantara) [RHEL-34672] - fs: cifs: Remove repeated struct declaration (Paulo Alcantara) [RHEL-34672] - cifs: have cifs_fattr_to_inode() refuse to change type on live inode (Paulo Alcantara) [RHEL-34672] - cifs: have ->mkdir() handle race with another client sanely (Paulo Alcantara) [RHEL-34672] - do_cifs_create(): don't set ->i_mode of something we had not created (Paulo Alcantara) [RHEL-34672] - cifs: Silently ignore unknown oplock break handle (Paulo Alcantara) [RHEL-34672] - cifs: change noisy error message to FYI (Paulo Alcantara) [RHEL-34672] - cifs: print MIDs in decimal notation (Paulo Alcantara) [RHEL-34672] - cifs: minor simplification to smb2_is_network_name_deleted (Paulo Alcantara) [RHEL-34672] - TCON Reconnect during STATUS_NETWORK_NAME_DELETED (Paulo Alcantara) [RHEL-34672] - cifs: clarify hostname vs ip address in /proc/fs/cifs/DebugData (Paulo Alcantara) [RHEL-34672] - cifs: change confusing field serverName (to ip_addr) (Paulo Alcantara) [RHEL-34672] - cifs: Reformat DebugData and index connections by conn_id. (Paulo Alcantara) [RHEL-34672] - cifs: Identify a connection by a conn_id. (Paulo Alcantara) [RHEL-34672] - smb3: negotiate current dialect (SMB3.1.1) when version 3 or greater requested (Paulo Alcantara) [RHEL-34672] - smb3: Fix out-of-bounds bug in SMB2_negotiate() (Paulo Alcantara) [RHEL-34672] - fs/cifs: Simplify bool comparison. (Paulo Alcantara) [RHEL-34672] - fs/cifs: Assign boolean values to a bool variable (Paulo Alcantara) [RHEL-34672] - cifs: Avoid error pointer dereference (Paulo Alcantara) [RHEL-34672] - cifs: Re-indent cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Unlock on errors in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Delete a stray unlock in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Tracepoints and logs for tracing credit changes. (Paulo Alcantara) [RHEL-34672] - cifs: Fix some error pointers handling detected by static checker (Paulo Alcantara) [RHEL-34672] - smb3: remind users that witness protocol is experimental (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: do not log warning message if server doesn't populate salt (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: update comments clarifying SPNEGO info in negprot response (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot rsp (Paulo Alcantara) [RHEL-34672] - SMB3: avoid confusing warning message on mount to Azure (Paulo Alcantara) [RHEL-34672] - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (Nigel Croxon) [RHEL-46662] {CVE-2024-39476} - net: fix information leakage in /proc/net/ptype (Hangbin Liu) [RHEL-44000] {CVE-2022-48757} - usb: typec: ucsi: Limit read size on v1.2 (Desnes Nunes) [RHEL-37286] {CVE-2024-35924} - minmax: relax check to allow comparison between unsigned arguments and signed constants (Desnes Nunes) [RHEL-37286] - minmax: allow comparisons of 'int' against 'unsigned char/short' (Desnes Nunes) [RHEL-37286] - minmax: allow min()/max()/clamp() if the arguments have the same signedness. (Desnes Nunes) [RHEL-37286] - minmax: add umin(a, b) and umax(a, b) (Desnes Nunes) [RHEL-37286] - minmax: fix header inclusions (Desnes Nunes) [RHEL-37286] - minmax: clamp more efficiently by avoiding extra comparison (Desnes Nunes) [RHEL-37286] - minmax: sanity check constant bounds when clamping (Desnes Nunes) [RHEL-37286] - tracing: Define the is_signed_type() macro once (Desnes Nunes) [RHEL-37286] - linux/bits.h: fix compilation error with GENMASK (Desnes Nunes) [RHEL-37286] - x86/apic: Mask IOAPIC entries when disabling the local APIC (Lenny Szubowicz) [RHEL-18077] - userfaultfd: fix a race between writeprotect and exit_mmap() (Rafael Aquini) [RHEL-38410] {CVE-2021-47461} - mm: khugepaged: skip huge page collapse for special files (Waiman Long) [RHEL-38446] {CVE-2021-47491} - cachefiles: fix memory leak in cachefiles_add_cache() (Andrey Albershteyn) [RHEL-33109] {CVE-2024-26840} - drm/amd/display: Implement bounds check for stream encoder creation in DCN301 (Michel Dänzer) [RHEL-31429] {CVE-2024-26660} - net/mlx5: Discard command completions in internal error (Kamal Heib) [RHEL-44231] {CVE-2024-38555} - drm: Don't unref the same fb many times by mistake due to deadlock handling (CKI Backport Bot) [RHEL-29011] {CVE-2023-52486} - md: fix resync softlockup when bitmap size is less than array size (Nigel Croxon) [RHEL-43942] {CVE-2024-38598} - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation (Davide Caratti) [RHEL-39712] {CVE-2024-36017} - netfilter: nf_tables: discard table flag update with pending basechain deletion (Phil Sutter) [RHEL-37205] {CVE-2024-35897} - netfilter: nf_tables: reject table flag and netdev basechain updates (Phil Sutter) [RHEL-37205] - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (Ewan D. Milne) [RHEL-40172] {CVE-2024-36924} - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (Ewan D. Milne) [RHEL-40172] {CVE-2024-36952} - netfilter: nf_tables: fix memleak in map from abort path (Phil Sutter) [RHEL-35052] {CVE-2024-27011} - netfilter: nf_tables: reject new basechain after table flag update (Phil Sutter) [RHEL-37193] {CVE-2024-35900} - netfilter: nf_tables: flush pending destroy work before exit_net release (Phil Sutter) [RHEL-37197] {CVE-2024-35899} - netfilter: complete validation of user input (Phil Sutter) [RHEL-37210] - netfilter: validate user input for expected length (Phil Sutter) [RHEL-37210] {CVE-2024-35896} - netfilter: tproxy: bail out if IP has been disabled on the device (Phil Sutter) [RHEL-44363] {CVE-2024-36270} - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (Phil Sutter) [RHEL-44532] {CVE-2024-36286} - netfilter: nf_tables: do not compare internal table flags on updates (Phil Sutter) [RHEL-35114] {CVE-2024-27065} - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (Phil Sutter) [RHEL-35028] {CVE-2024-27019} - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (Phil Sutter) [RHEL-35024] {CVE-2024-27020} - netfilter: nf_tables: __nft_expr_type_get() selects specific family type (Phil Sutter) [RHEL-35024] - netfilter: conntrack: serialize hash resizes and cleanups (Phil Sutter) [RHEL-37703] {CVE-2021-47408} - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (Phil Sutter) [RHEL-34217] {CVE-2024-26925} - netfilter: nf_tables: release batch on table validation from abort path (Phil Sutter) [RHEL-34217] - ipvlan: add ipvlan_route_v6_outbound() helper (Davide Caratti) [RHEL-38319] {CVE-2023-52796} - [rt] build kernel-rt-4.18.0-553.12.1.rt7.353.el8_10 [RHEL-44553] - net: bridge: xmit: make sure we have at least eth header len bytes (cki-backport-bot) [RHEL-44291] {CVE-2024-38538} - drivers/amd/pm: fix a use-after-free in kv_parse_power_table (Michel Dänzer) [RHEL-26893] {CVE-2023-52469} - SUNRPC: Fix a suspicious RCU usage warning (Scott Mayhew) [RHEL-30503] {CVE-2023-52623} - ice: Fix some null pointer dereference issues in ice_ptp.c (Petr Oros) [RHEL-26901] {CVE-2023-52471} - xfs: fix internal error from AGFL exhaustion (Pavel Reichl) [RHEL-45581] - sched/psi: Fix use-after-free in ep_remove_wait_queue() (Phil Auld) [RHEL-38117] {CVE-2023-52707} - wait: add wake_up_pollfree() (Phil Auld) [RHEL-38117] - net/ipv6: avoid possible UAF in ip6_route_mpath_notify() (Hangbin Liu) [RHEL-33269] {CVE-2024-26852} - net: bridge: switchdev: Skip MDB replays of deferred events on offload (Ivan Vecera) [RHEL-33117] {CVE-2024-26837} - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (Pavel Reichl) [RHEL-31700] {CVE-2024-26772} - ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() (Pavel Reichl) [RHEL-31688] {CVE-2024-26773} - ext4: fix double-free of blocks due to wrong extents moved_len (Pavel Reichl) [RHEL-31612] {CVE-2024-26704} - vxlan: Pull inner IP header in vxlan_xmit_one(). (Guillaume Nault) [RHEL-31389] - geneve: Fix incorrect inner network header offset when innerprotoinherit is set (Guillaume Nault) [RHEL-31389] - vxlan: Pull inner IP header in vxlan_rcv(). (Guillaume Nault) [RHEL-31389] - geneve: fix header validation in geneve[6]_xmit_skb (Guillaume Nault) [RHEL-31389] - geneve: make sure to pull inner header in geneve_rx() (Guillaume Nault) [RHEL-31389] - net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb (Guillaume Nault) [RHEL-31389] - net: geneve: check skb is large enough for IPv4/IPv6 header (Guillaume Nault) [RHEL-31389] - net/smc: fix neighbour and rtable leak in smc_ib_find_route() (Tobias Huschle) [RHEL-39744] {CVE-2024-36945} - igb: Fix string truncation warnings in igb_set_fw_version (Corinna Vinschen) [RHEL-38452] {CVE-2024-36010} - bonding: stop the device in bond_setup_by_slave() (Hangbin Liu) [RHEL-38327] {CVE-2023-52784} - i40e: fix vf may be used uninitialized in this function warning (Kamal Heib) [RHEL-39702] {CVE-2024-36020} - powerpc/64: Fix the definition of the fixmap area (Mamatha Inamdar) [RHEL-27191] {CVE-2021-47018} - powerpc/mm/hash64: Add a variable to track the end of IO mapping (Mamatha Inamdar) [RHEL-27191] {CVE-2021-47018} - nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). (Xin Long) [RHEL-39770] {CVE-2024-36933} - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (Xin Long) [RHEL-39770] - net: core: reject skb_copy(_expand) for fraglist GSO skbs (Xin Long) [RHEL-39779] {CVE-2024-36929} - tcp: properly terminate timers for kernel sockets (Guillaume Nault) [RHEL-37171] {CVE-2024-35910} - net: relax socket state check at accept time. (Florian Westphal) [RHEL-39831] - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (Florian Westphal) [RHEL-39831] {CVE-2024-36905} - tcp: remove redundant check on tskb (Florian Westphal) [RHEL-39831] - drm/ast: Fix soft lockup (cki-backport-bot) [RHEL-37438] {CVE-2024-35952} - null_blk: Fix return value of nullb_device_power_store() (Ming Lei) [RHEL-39341] - null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues' (Ming Lei) [RHEL-39341] - null_blk: fix return value from null_add_dev() (Ming Lei) [RHEL-39341] - [rt] build kernel-rt-4.18.0-553.11.1.rt7.352.el8_10 [RHEL-44553] - x86/bugs: Reverse instruction order of CLEAR_CPU_BUFFERS (Waiman Long) [RHEL-42121] - Revert "x86/bugs: Use fixed addressing for VERW operand" (Waiman Long) [RHEL-42121] - KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests (Waiman Long) [RHEL-42121] - x86/rfds: Mitigate Register File Data Sampling (RFDS) (Waiman Long) [RHEL-42121] - Documentation/hw-vuln: Add documentation for RFDS (Waiman Long) [RHEL-42121] - x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set (Waiman Long) [RHEL-42121] - x86/bugs: Use fixed addressing for VERW operand (Waiman Long) [RHEL-42121] - KVM/VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH (Waiman Long) [RHEL-42121] - x86/bugs: Use ALTERNATIVE() instead of mds_user_clear static key (Waiman Long) [RHEL-42121] - x86/entry_32: Add VERW just before userspace transition (Waiman Long) [RHEL-42121] - x86/entry_64: Add VERW just before userspace transition (Waiman Long) [RHEL-42121] - x86/bugs: Add asm helpers for executing VERW (Waiman Long) [RHEL-42121] - x86/cpu: Fix Gracemont uarch (Waiman Long) [RHEL-42121] - Documentation/hw-vuln: Unify filename specification in index (Waiman Long) [RHEL-42121] - KVM: VMX: Access @flags as a 32-bit value in __vmx_vcpu_run() (Waiman Long) [RHEL-42121] - x86/asm: Add _ASM_RIP() macro for x86-64 (%rip) suffix (Waiman Long) [RHEL-42121] - x86/asm: Have the __ASM_FORM macros handle commas in arguments (Waiman Long) [RHEL-42121] - x86/asm: Allow to pass macros to __ASM_FORM() (Waiman Long) [RHEL-42121] - wifi: iwlwifi: mvm: guard against invalid STA ID on removal (Jose Ignacio Tornos Martinez) [RHEL-39801] {CVE-2024-36921} - ipv6: Fix potential uninit-value access in __ip6_make_skb() (Antoine Tenart) [RHEL-39784] - ipv4: Fix uninit-value access in __ip_make_skb() (Antoine Tenart) [RHEL-39784] {CVE-2024-36927} - perf mmap: Lazily initialize zstd streams to save memory when not using it (Michael Petlan) [RHEL-34876] - perf tools: Fix spelling mistake "commpressor" -> "compressor" (Michael Petlan) [RHEL-34876] - perf record: Introduce data transferred and compressed stats (Michael Petlan) [RHEL-34876] - perf record: Introduce compressor at mmap buffer object (Michael Petlan) [RHEL-34876] - perf record: Introduce bytes written stats (Michael Petlan) [RHEL-34876] - perf record: Introduce data file at mmap buffer object (Michael Petlan) [RHEL-34876] - perf record: Start threads in the beginning of trace streaming (Alexey Bayduraev) [RHEL-34876] - perf record: Stop threads in the end of trace streaming (Michael Petlan) [RHEL-34876] - perf record: Introduce thread local variable (Michael Petlan) [RHEL-34876] - perf record: Introduce function to propagate control commands (Michael Petlan) [RHEL-34876] - perf record: Introduce thread specific data array (Michael Petlan) [RHEL-34876] - tools lib: Introduce fdarray duplicate function (Michael Petlan) [RHEL-34876] - perf record: Introduce thread affinity and mmap masks (Michael Petlan) [RHEL-34876] - gfs2: Be more careful with the quota sync generation (Andreas Gruenbacher) [RHEL-40901] - gfs2: Get rid of some unnecessary quota locking (Andreas Gruenbacher) [RHEL-40901] - gfs2: Add some missing quota locking (Andreas Gruenbacher) [RHEL-40901] - gfs2: Fold qd_fish into gfs2_quota_sync (Andreas Gruenbacher) [RHEL-40901] - gfs2: quota need_sync cleanup (Andreas Gruenbacher) [RHEL-40901] - gfs2: Fix and clean up function do_qc (Andreas Gruenbacher) [RHEL-40901] - gfs2: Revert "Add quota_change type" (Andreas Gruenbacher) [RHEL-40901] - gfs2: Revert "ignore negated quota changes" (Andreas Gruenbacher) [RHEL-40901] - gfs2: qd_check_sync cleanups (Andreas Gruenbacher) [RHEL-40901] - gfs2: Check quota consistency on mount (Andreas Gruenbacher) [RHEL-40901] - gfs2: Minor gfs2_quota_init error path cleanup (Andreas Gruenbacher) [RHEL-40901] - gfs2: fix kernel BUG in gfs2_quota_cleanup (Edward Adam Davis) [RHEL-40901] - gfs2: Clean up quota.c:print_message (Andreas Gruenbacher) [RHEL-40901] - gfs2: Clean up gfs2_alloc_parms initializers (Andreas Gruenbacher) [RHEL-40901] - gfs2: Two quota=account mode fixes (Andreas Gruenbacher) [RHEL-40901] - gfs2: Remove useless assignment (Bob Peterson) [RHEL-40901] - gfs2: simplify slot_get (Bob Peterson) [RHEL-40901] - gfs2: Simplify qd2offset (Bob Peterson) [RHEL-40901] - gfs2: Remove quota allocation info from quota file (Bob Peterson) [RHEL-40901] - gfs2: use constant for array size (Bob Peterson) [RHEL-40901] - gfs2: Set qd_sync_gen in do_sync (Bob Peterson) [RHEL-40901] - gfs2: Remove useless err set (Bob Peterson) [RHEL-40901] - gfs2: Small gfs2_quota_lock cleanup (Bob Peterson) [RHEL-40901] - gfs2: move qdsb_put and reduce redundancy (Bob Peterson) [RHEL-40901] - gfs2: Don't try to sync non-changes (Bob Peterson) [RHEL-40901] - gfs2: Simplify function need_sync (Bob Peterson) [RHEL-40901] - gfs2: remove unneeded pg_oflow variable (Bob Peterson) [RHEL-40901] - gfs2: remove unneeded variable done (Bob Peterson) [RHEL-40901] - gfs2: pass sdp to gfs2_write_buf_to_page (Bob Peterson) [RHEL-40901] - gfs2: pass sdp in to gfs2_write_disk_quota (Bob Peterson) [RHEL-40901] - gfs2: Pass sdp to gfs2_adjust_quota (Bob Peterson) [RHEL-40901] - gfs2: remove dead code for quota writes (Bob Peterson) [RHEL-40901] - gfs2: Use qd_sbd more consequently (Bob Peterson) [RHEL-40901] - gfs2: replace 'found' with dedicated list iterator variable (Jakob Koschel) [RHEL-40901] - gfs2: Some whitespace cleanups (Andreas Gruenbacher) [RHEL-40901] - gfs2: Fix gfs2_qa_get imbalance in gfs2_quota_hold (Bob Peterson) [RHEL-40901] - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg (Guillaume Nault) [RHEL-43961] {CVE-2024-38596} - af_unix: Fix data-races around sk->sk_shutdown. (Guillaume Nault) [RHEL-43961] {CVE-2024-38596} - af_unix: Fix data races around sk->sk_shutdown. (Guillaume Nault) [RHEL-43961] {CVE-2024-38596} - perf/core: Fix event sibling list locking (Daniel Vacek) [RHEL-31798] - media: bttv: fix use after free error due to btv->timeout timer (Kate Hsuan) [RHEL-38256] {CVE-2023-52847} - arp: Prevent overflow in arp_req_get(). (Antoine Tenart) [RHEL-31706] {CVE-2024-26733} - Bluetooth: btusb: Add a new PID/VID 0489/e0c8 for MT7921 (David Marlin) [RHEL-10263] - mm: swap: fix race between free_swap_and_cache() and swapoff() (Waiman Long) [RHEL-34971] {CVE-2024-26960} - swap: comments get_swap_device() with usage rule (Waiman Long) [RHEL-34971] {CVE-2024-26960} - mm/swapfile.c: __swap_entry_free() always free 1 entry (Waiman Long) [RHEL-34971] {CVE-2024-26960} - mm/swapfile.c: call free_swap_slot() in __swap_entry_free() (Waiman Long) [RHEL-34971] {CVE-2024-26960} - mm/swapfile.c: use __try_to_reclaim_swap() in free_swap_and_cache() (Waiman Long) [RHEL-34971] {CVE-2024-26960} - net: amd-xgbe: Fix skb data length underflow (Ken Cox) [RHEL-43788] {CVE-2022-48743} - ovl: fix warning in ovl_create_real() (cki-backport-bot) [RHEL-43652] {CVE-2021-47579} - net/sched: initialize noop_qdisc owner (Davide Caratti) [RHEL-35056] - net/sched: Fix mirred deadlock on device recursion (Davide Caratti) [RHEL-35056] {CVE-2024-27010} - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (Pavel Reichl) [RHEL-45029] {CVE-2024-39276} - ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() (Ken Cox) [RHEL-38713] {CVE-2021-47548} - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound (Hangbin Liu) [RHEL-44396] {CVE-2024-33621} - mlxsw: spectrum_acl_tcam: Fix stack corruption (Ivan Vecera) [RHEL-26462] {CVE-2024-26586} - inet: inet_defrag: prevent sk release while still in use (Antoine Tenart) [RHEL-33398] {CVE-2024-26921} - skb_expand_head() adjust skb->truesize incorrectly (Antoine Tenart) [RHEL-33398] - nvmet: fix ns enable/disable possible hang (Ming Lei) [RHEL-43547] - [rt] build kernel-rt-4.18.0-553.10.1.rt7.351.el8_10 [RHEL-44553] - SUNRPC: Fix RPC client cleaned up the freed pipefs dentries (Scott Mayhew) [RHEL-38264] {CVE-2023-52803} - scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() (Ewan D. Milne) [RHEL-39717] {CVE-2024-36025} - tcp: add sanity checks to rx zerocopy (Guillaume Nault) [RHEL-29494] {CVE-2024-26640} - SUNRPC: fix some memleaks in gssx_dec_option_array (Scott Mayhew) [RHEL-35209] {CVE-2024-27388} - wifi: nl80211: don't free NULL coalescing rule (Jose Ignacio Tornos Martinez) [RHEL-39752] {CVE-2024-36941} - nfs: fix UAF in direct writes (Scott Mayhew) [RHEL-34975] {CVE-2024-26958} - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 (Scott Mayhew) [RHEL-33228] {CVE-2024-26870} - drm/amd/pm: Fix error of MACO flag setting code (Michel Dänzer) [RHEL-15928] - scsi: aacraid: fix io hangs and improve performance (John Meneghini) [RHEL-23913] - block: prevent division by zero in blk_rq_stat_sum() (Ming Lei) [RHEL-37279] {CVE-2024-35925} - block: fix overflow in blk_ioctl_discard() (Ming Lei) [RHEL-39811] {CVE-2024-36917} - virtio-blk: fix implicit overflow on virtio_max_dma_size (Ming Lei) [RHEL-38131] {CVE-2023-52762} - nbd: null check for nla_nest_start (Ming Lei) [RHEL-35176] {CVE-2024-27025} - isdn: mISDN: netjet: Fix crash in nj_probe: (Ken Cox) [RHEL-38444] {CVE-2021-47284} - isdn: mISDN: Fix sleeping function called from invalid context (Ken Cox) [RHEL-38400] {CVE-2021-47468} - net/smc: avoid data corruption caused by decline (Tobias Huschle) [RHEL-38234] {CVE-2023-52775} - ubi: Check for too small LEB size in VTBL code (David Arcari) [RHEL-25092] {CVE-2024-25739} - i2c: core: Fix atomic xfer check for non-preempt config (Steve Best) [RHEL-38313] {CVE-2023-52791} - i2c: core: Run atomic i2c xfer when !preemptible (Steve Best) [RHEL-38313] {CVE-2023-52791} - firewire: ohci: mask bus reset interrupts between ISR and bottom half (Steve Best) [RHEL-39902] {CVE-2024-36950} - ipv6: init the accept_queue's spinlocks in inet6_create (Guillaume Nault) [RHEL-28899] {CVE-2024-26614} - tcp: make sure init the accept_queue's spinlocks once (Guillaume Nault) [RHEL-28899] {CVE-2024-26614} - tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (Steve Best) [RHEL-39352] {CVE-2024-36016} - mlxsw: spectrum_acl_tcam: Fix incorrect list API usage (Ivan Vecera) [RHEL-37484] {CVE-2024-36006} - pwm: Fix double shift bug (Steve Best) [RHEL-38278] {CVE-2023-52756} - mmc: sdio: fix possible resource leaks in some error paths (Steve Best) [RHEL-38149] {CVE-2023-52730} - of: unittest: Fix compile in the non-dynamic case (Steve Best) [RHEL-37070] {CVE-2023-52679} - of: unittest: Fix of_count_phandle_with_args() expected value message (Steve Best) [RHEL-37070] {CVE-2023-52679} - of: Fix double free in of_parse_phandle_with_args_map (Steve Best) [RHEL-37070] {CVE-2023-52679} - pinctrl: core: delete incorrect free in pinctrl_enable() (Steve Best) [RHEL-39756] {CVE-2024-36940} - pinctrl: core: fix possible memory leak in pinctrl_enable() (Steve Best) [RHEL-39756] {CVE-2024-36940} - media: gspca: cpia1: shift-out-of-bounds in set_flicker (Desnes Nunes) [RHEL-38331] {CVE-2023-52764} - tipc: fix a possible memleak in tipc_buf_append (Xin Long) [RHEL-39881] {CVE-2024-36954} - cifs: fix mid leak during reconnection after timeout threshold (Paulo Alcantara) [RHEL-36222] - cifs: Fix use-after-free in rdata->read_into_pages() (Paulo Alcantara) [RHEL-36222] - cifs: Fix pages leak when writedata alloc failed in cifs_write_from_iter() (Paulo Alcantara) [RHEL-36222] - cifs: Fix pages array leak when writedata alloc failed in cifs_writedata_alloc() (Paulo Alcantara) [RHEL-36222] - cifs: destage dirty pages before re-reading them for cache=none (Paulo Alcantara) [RHEL-36222] - cifs: destage any unwritten data to the server before calling copychunk_write (Paulo Alcantara) [RHEL-36222] - Adjust cifssb maximum read size (Paulo Alcantara) [RHEL-36222] - cifs: make locking consistent around the server session status (Paulo Alcantara) [RHEL-36222] - cifs: fix credit accounting for extra channel (Paulo Alcantara) [RHEL-36222] - smb3: prevent races updating CurrentMid (Paulo Alcantara) [RHEL-36222] - cifs: fix missing spinlock around update to ses->status (Paulo Alcantara) [RHEL-36222] - cifs: use echo_interval even when connection not ready. (Paulo Alcantara) [RHEL-36222] - cifs: detect dead connections only when echoes are enabled. (Paulo Alcantara) [RHEL-36222] - cifs: Fix preauth hash corruption (Paulo Alcantara) [RHEL-36222] - cifs: do not send close in compound create+close requests (Paulo Alcantara) [RHEL-36222] - cifs: ask for more credit on async read/write code paths (Paulo Alcantara) [RHEL-36222] - cifs: use discard iterator to discard unneeded network data more efficiently (Paulo Alcantara) [RHEL-36222] - cifs: Fix in error types returned for out-of-credit situations. (Paulo Alcantara) [RHEL-36222] - smb3: fix crediting for compounding when only one request in flight (Paulo Alcantara) [RHEL-36222] - cifs: New optype for session operations. (Paulo Alcantara) [RHEL-36222] - mm/gup: do not return 0 from pin_user_pages_fast() for bad args (Paulo Alcantara) [RHEL-36222] - wifi: brcmfmac: pcie: handle randbuf allocation failure (Jose Ignacio Tornos Martinez) [RHEL-44124] {CVE-2024-38575} - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). (Guillaume Nault) [RHEL-39835] {CVE-2024-36904} - wifi: mac80211: don't return unset power in ieee80211_get_tx_power() (Jose Ignacio Tornos Martinez) [RHEL-38159] {CVE-2023-52832} - wifi: ath11k: fix gtk offload status event locking (Jose Ignacio Tornos Martinez) [RHEL-38155] {CVE-2023-52777} - net: ieee802154: fix null deref in parse dev addr (Steve Best) [RHEL-38012] {CVE-2021-47257} - mm/hugetlb: fix missing hugetlb_lock for resv uncharge (Rafael Aquini) [RHEL-37465] {CVE-2024-36000} - x86/xen: Add some null pointer checking to smp.c (Vitaly Kuznetsov) [RHEL-33258] {CVE-2024-26908} - x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() (Vitaly Kuznetsov) [RHEL-33258] {CVE-2024-26908} - wifi: cfg80211: check A-MSDU format more carefully (Jose Ignacio Tornos Martinez) [RHEL-37343] {CVE-2024-35937} - wifi: rtw89: fix null pointer access when abort scan (Jose Ignacio Tornos Martinez) [RHEL-37355] {CVE-2024-35946} - atl1c: Work around the DMA RX overflow issue (Ken Cox) [RHEL-38287] {CVE-2023-52834} - wifi: ath11k: decrease MHI channel buffer length to 8KB (Jose Ignacio Tornos Martinez) [RHEL-37339] {CVE-2024-35938} - wifi: iwlwifi: mvm: rfi: fix potential response leaks (Jose Ignacio Tornos Martinez) [RHEL-37163] {CVE-2024-35912} - USB: core: Fix access violation during port device removal (Desnes Nunes) [RHEL-39853] {CVE-2024-36896} - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() (Ewan D. Milne) [RHEL-37123] {CVE-2024-35930} - netfilter: nf_tables: honor table dormant flag from netdev release event path (Phil Sutter) [RHEL-37450] {CVE-2024-36005} - wifi: iwlwifi: mvm: don't set the MFP flag for the GTK (Jose Ignacio Tornos Martinez) [RHEL-36898] {CVE-2024-27434} - wifi: iwlwifi: mvm: Fix key flags for IGTK on AP interface (Jose Ignacio Tornos Martinez) [RHEL-36898] {CVE-2024-27434} - misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspend/resume (Steve Best) [RHEL-36932] {CVE-2024-35824} - [rt] build kernel-rt-4.18.0-553.9.1.rt7.350.el8_10 [RHEL-44553] - x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (Steve Best) [RHEL-37262] {CVE-2024-35876} - net/sched: flower: Fix chain template offload (Xin Long) [RHEL-31313] {CVE-2024-26669} - SUNRPC: fix a memleak in gss_import_v2_context (Scott Mayhew) [RHEL-35195] {CVE-2023-52653} - efivarfs: force RO when remounting if SetVariable is not supported (Pavel Reichl) [RHEL-26564] {CVE-2023-52463} - dmaengine: idxd: add a write() method for applications to submit work (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823} - dmaengine: idxd: add a new security check to deal with a hardware erratum (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823} - VFIO: Add the SPR_DSA and SPR_IAX devices to the denylist (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823} - quota: Fix potential NULL pointer dereference (Pavel Reichl) [RHEL-33219] {CVE-2024-26878} - locking/lockdep: Fix overflow in presentation of average lock-time (Čestmír Kalina) [RHEL-17678] - blk-cgroup: Properly propagate the iostat update up the hierarchy (Ming Lei) [RHEL-40939] - proc: Use new_inode not new_inode_pseudo (Ian Kent) [RHEL-40167] - stmmac: Clear variable when destroying workqueue (Izabela Bakollari) [RHEL-31822] {CVE-2024-26802} - powerpc/pseries/memhp: Fix access beyond end of drmem array (Mamatha Inamdar) [RHEL-26495] {CVE-2023-52451} - platform/x86: wmi: Fix opening of char device (David Arcari) [RHEL-38258] {CVE-2023-52864} - Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" (Kamal Heib) [RHEL-36908] {CVE-2023-52658} - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed (Cathy Avery) [RHEL-39074] - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove (Cathy Avery) [RHEL-39074] - hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes (Cathy Avery) [RHEL-39074] - hv_netvsc: remove duplicated including of slab.h (Cathy Avery) [RHEL-39074] - hv_netvsc: rndis_filter needs to select NLS (Cathy Avery) [RHEL-39074] - hv_netvsc: Mark VF as slave before exposing it to user-mode (Cathy Avery) [RHEL-39074] - hv_netvsc: Fix race of register_netdevice_notifier and VF register (Cathy Avery) [RHEL-39074] - hv_netvsc: fix race of netvsc and VF register_netdevice (Cathy Avery) [RHEL-39074] - hv_netvsc: fix netvsc_send_completion to avoid multiple message length checks (Cathy Avery) [RHEL-39074] - hv_netvsc: Allocate rx indirection table size dynamically (Cathy Avery) [RHEL-39074] - net: hv_netvsc: Fix a warning triggered by memcpy in rndis_filter (Cathy Avery) [RHEL-39074] - gfs2: Fix lru_count accounting (Andreas Gruenbacher) [RHEL-32941] - gfs2: Fix "Make glock lru list scanning safer" (Andreas Gruenbacher) [RHEL-32941] - gfs2: Fix "ignore unlock failures after withdraw" (Andreas Gruenbacher) [RHEL-32941] - gfs2: Don't set GLF_LOCK in gfs2_dispose_glock_lru (Andreas Gruenbacher) [RHEL-32941] - gfs2: Don't forget to complete delayed withdraw (Andreas Gruenbacher) [RHEL-32941] - gfs2: Delay withdraw from atomic context (Andreas Gruenbacher) [RHEL-32941] - gfs2: trivial clean up of gfs2_ail_error (Andreas Gruenbacher) [RHEL-32941] - ext4: fix corruption during on-line resize (Carlos Maiolino) [RHEL-36974] {CVE-2024-35807} - ext4: correct offset of gdb backup in non meta_bg group to update_backups (Carlos Maiolino) [RHEL-36974] - ext4: avoid online resizing failures due to oversized flex bg (Carlos Maiolino) [RHEL-30507] {CVE-2023-52622} - ext4: use time_is_before_jiffies() instead of open coding it (Carlos Maiolino) [RHEL-30507] - ext4: unify the type of flexbg_size to unsigned int (Carlos Maiolino) [RHEL-30507] - ext4: remove unnecessary check from alloc_flex_gd() (Carlos Maiolino) [RHEL-30507] - tracing: Do no increment trace_clock_global() by one (Jerome Marchand) [RHEL-27107] {CVE-2021-46939} - tracing: Restructure trace_clock_global() to never block (Jerome Marchand) [RHEL-27107] {CVE-2021-46939} - net/sched: act_skbmod: prevent kernel-infoleak (Xin Long) [RHEL-37220] {CVE-2024-35893} - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (Xin Long) [RHEL-38307] {CVE-2023-52845} - redhat: remove the merge subtrees script (Derek Barbosa) - redhat: rhdocs: delete .get_maintainer.conf (Derek Barbosa) - redhat: rhdocs: Remove the rhdocs directory (Derek Barbosa) - dyndbg: fix old BUG_ON in >control parser (Waiman Long) [RHEL-37111] {CVE-2024-35947} - dyndbg: let query-modname override actual module name (Waiman Long) [RHEL-37111] - dyndbg: make dyndbg a known cli param (Waiman Long) [RHEL-37111] - lan78xx: Fix exception on link speed change (Jamie Bainbridge) [RHEL-33437] - net: usb: lan78xx: don't modify phy_device state concurrently (Jamie Bainbridge) [RHEL-33437] - efi: runtime: Fix potential overflow of soft-reserved region size (Lenny Szubowicz) [RHEL-33096] {CVE-2024-26843} - perf/arm-cmn: Fail DTC counter allocation correctly (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Rework DTC counters (again) (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Fix DTC domain detection (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Revamp model detection (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Fix port detection for CMN-700 (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Move overlapping wp_combine field (Michael Petlan) [RHEL-23841] - Partially revert "perf/arm-cmn: Optimise DTC counter accesses" (Michael Petlan) [RHEL-23841] - drivers/perf: Compile with gnu99 standard (Michael Petlan) [RHEL-23841] - x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (Steve Best) [RHEL-36994] {CVE-2024-35801} - watchdog: softdog: Add options 'soft_reboot_cmd' and 'soft_active_on_boot' (Waiman Long) [RHEL-19723] - tipc: fix UAF in error path (Xin Long) [RHEL-34278] {CVE-2024-36886} - [rt] build kernel-rt-4.18.0-553.8.1.rt7.349.el8_10 [RHEL-40882] - udf: Fix NULL pointer dereference in udf_symlink function (Pavel Reichl) [RHEL-37769] {CVE-2021-47353} - net: ti: fix UAF in tlan_remove_one (Jose Ignacio Tornos Martinez) [RHEL-38940] {CVE-2021-47310} - ARM: footbridge: fix PCI interrupt mapping (Myron Stowe) [RHEL-26971] {CVE-2021-46909} - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (Kamal Heib) [RHEL-37454] {CVE-2024-36004} - net/mlx5e: Fix mlx5e_priv_init() cleanup flow (Kamal Heib) [RHEL-37424] {CVE-2024-35959} - net/mlx5: Properly link new fs rules into the tree (Kamal Heib) [RHEL-37420] {CVE-2024-35960} - net/mlx5e: fix a potential double-free in fs_any_create_groups (Kamal Heib) [RHEL-37091] {CVE-2023-52667} - net: ena: Fix incorrect descriptor free behavior (Kamal Heib) [RHEL-37428] {CVE-2024-35958} - mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - mISDN: fix possible use-after-free in HFC_cleanup() (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - implement dh fallback for primes > 4K (Vladis Dronov) [RHEL-35106] - crypto: qat - avoid division by zero (Vladis Dronov) [RHEL-35106] - crypto: qat - resolve race condition during AER recovery (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - use kcalloc_node() instead of kzalloc_node() (Vladis Dronov) [RHEL-35106] - [rt] Enable CONFIG_DRM_MGAG200_DISABLE_WRITECOMBINE (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Add an option to disable Write-Combine (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Fix caching setup for remapped video memory (Jocelyn Falempe) [RHEL-36172] - Revert "drm/mgag200: Add a workaround for low-latency" (Jocelyn Falempe) [RHEL-36172] - mptcp: fix data re-injection from stale subflow (Davide Caratti) [RHEL-33133] {CVE-2024-26826} - ipv6: sr: fix incorrect unregister order (Hangbin Liu) [RHEL-31730] - ipv6: sr: fix possible use-after-free and null-ptr-deref (Hangbin Liu) [RHEL-31730] {CVE-2024-26735} - net/bnx2x: Prevent access to a freed page in page_pool (Michal Schmidt) [RHEL-14195 RHEL-33243] {CVE-2024-26859} - bnx2x: new flag for track HW resource allocation (Michal Schmidt) [RHEL-14195 RHEL-33243] - bnx2x: fix page fault following EEH recovery (Michal Schmidt) [RHEL-14195 RHEL-33243] - x86: KVM: SVM: always update the x2avic msr interception (Maxim Levitsky) [RHEL-15495] {CVE-2023-5090} - EDAC/thunderx: Fix possible out-of-bounds string access (Aristeu Rozanski) [RHEL-26573] {CVE-2023-52464} - [rt] build kernel-rt-4.18.0-553.7.1.rt7.348.el8_10 [RHEL-34640] - net: qcom/emac: fix UAF in emac_remove (Ken Cox) [RHEL-37834] {CVE-2021-47311} - perf/core: Bail out early if the request AUX area is out of bound (Michael Petlan) [RHEL-38268] {CVE-2023-52835} - crypto: pcrypt - Fix hungtask for PADATA_RESET (Herbert Xu) [RHEL-38171] {CVE-2023-52813} - drm/amdgpu: fix use-after-free bug (Jocelyn Falempe) [RHEL-31240] {CVE-2024-26656} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash (Ivan Vecera) [RHEL-37008] {CVE-2024-35854} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update (Ivan Vecera) [RHEL-37004] {CVE-2024-35855} - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (Ivan Vecera) [RHEL-37012] {CVE-2024-35853} - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work (Ivan Vecera) [RHEL-37016] {CVE-2024-35852} - mlxsw: spectrum_acl_tcam: Fix warning during rehash (Ivan Vecera) [RHEL-37480] {CVE-2024-36007} - can: peak_pci: peak_pci_remove(): fix UAF (Jose Ignacio Tornos Martinez) [RHEL-38419] {CVE-2021-47456} - usbnet: fix error return code in usbnet_probe() (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - usbnet: sanity check for maxpacket (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - net/mlx5e: fix a double-free in arfs_create_groups (Kamal Heib) [RHEL-36920] {CVE-2024-35835} - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds (Jose Ignacio Tornos Martinez) [RHEL-38220] {CVE-2023-52878} - net: cdc_eem: fix tx fixup skb leak (Jose Ignacio Tornos Martinez) [RHEL-38080] {CVE-2021-47236} - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Jose Ignacio Tornos Martinez) [RHEL-38113] {CVE-2023-52703} - usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() (Desnes Nunes) [RHEL-38248] {CVE-2023-52877} - usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (Desnes Nunes) [RHEL-38240] {CVE-2023-52781} - gro: fix ownership transfer (Xin Long) [RHEL-37226] {CVE-2024-35890} - tipc: fix kernel warning when sending SYN message (Xin Long) [RHEL-38109] {CVE-2023-52700} - erspan: make sure erspan_base_hdr is present in skb->head (Xin Long) [RHEL-37230] {CVE-2024-35888} - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() (Bryan Gurney) [RHEL-17366] - scsi: mpi3mr: Sanitise num_phys (Bryan Gurney) [RHEL-17366] - netfilter: nf_tables: use timestamp to check for set element timeout (Phil Sutter) [RHEL-38023] {CVE-2024-27397} - net/ipv6: SKB symmetric hash should incorporate transport ports (Sabrina Dubroca) [RHEL-32061] - crypto: s390/aes - Fix buffer overread in CTR mode (Herbert Xu) [RHEL-37089] {CVE-2023-52669} - net: Save and restore msg_namelen in sock_sendmsg (Jamie Bainbridge) [RHEL-35893] - net: prevent address rewrite in kernel_bind() (Jamie Bainbridge) [RHEL-35893] - net: prevent rewrite of msg_name in sock_sendmsg() (Jamie Bainbridge) [RHEL-35893] - net: replace calls to sock->ops->connect() with kernel_connect() (Jamie Bainbridge) [RHEL-35893] - net: Avoid address overwrite in kernel_connect (Jamie Bainbridge) [RHEL-35893] - wifi: iwlwifi: dbg-tlv: ensure NUL termination (Jose Ignacio Tornos Martinez) [RHEL-37026] {CVE-2024-35845} - wifi: mac80211: fix potential sta-link leak (Jose Ignacio Tornos Martinez) [RHEL-36916] {CVE-2024-35838} - wifi: nl80211: reject iftype change with mesh ID change (Jose Ignacio Tornos Martinez) [RHEL-36884] {CVE-2024-27410} - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (Jose Ignacio Tornos Martinez) [RHEL-36807] {CVE-2024-35789} - Bluetooth: Avoid potential use-after-free in hci_error_reset (David Marlin) [RHEL-31826] {CVE-2024-26801} - tls: disable async encrypt/decrypt (Sabrina Dubroca) [RHEL-26362 RHEL-26409 RHEL-26420] {CVE-2024-26585 CVE-2024-26583 CVE-2024-26584} - Squashfs: check the inode number is not the invalid value of zero (Phillip Lougher) [RHEL-35096] {CVE-2024-26982} - ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/msg.c: update and document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/sem.c: document and update memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: update/document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: remove duplicated code (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (Kamal Heib) [RHEL-30582] {CVE-2023-52626} - Revert "ACPI: bus: Rework system-level device notification handling" (Prarit Bhargava) [RHEL-21486] - hwrng: core - Fix page fault dead lock on mmap-ed hwrng (Prarit Bhargava) [RHEL-29485] {CVE-2023-52615} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - powerpc/pseries: pci - logic bug (Mamatha Inamdar) [RHEL-240146] - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228} - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899] {CVE-2026-90036} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680] {CVE-2026-72262} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641} - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781] {CVE-2026-74583} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916] {CVE-2026-68377} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271288] {CVE-2026-89631} - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280060] {CVE-2026-98320} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271853] {CVE-2026-93817} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191034] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191034] {CVE-2026-53196} - gfs2: a minor finish_xmote cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor run_queue fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: only apply DLM_LKF_VALBLK if sb_lvbptr is not NULL (Alexander Aring) [RHEL-129363] - gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Use wait_event_freezable_timeout() for freezable kthread (Andreas Gruenbacher) [RHEL-129363] - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-129363] - gfs2: low-memory forced flush fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: add missing withdraw locking (Andreas Gruenbacher) [RHEL-129363] - gfs2: Disable GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename "gfs_recovery" workqueue to "gfs2_recovery" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-129363] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-129363] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify do_promote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-129363] - gfs2: introduce new gfs2_glock_assert_withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify refcounting in do_xmote (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Make recovery error more readable (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark the remaining process-independent glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark flock glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of newlines in log messages (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-129363] - gfs2: Sanitize kthread stopping (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix logd wakeup on I/O error (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_quotad (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_logd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove duplicate check in do_xmote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove space before newline (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix LM_FLAG_TRY* logic in add_to_queue (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove DLM_LKF_ALTCW / DLM_LKF_ALTPR code (Andreas Gruenbacher) [RHEL-129363] - gfs2: Further sanitize lock_dlm.c (Andreas Gruenbacher) [RHEL-129363] - gfs2: sanitize the gdlm_ast -> finish_xmote interface (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify DLM_LKF_QUECVT use (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-129363] - gfs2: Lift withdraw check out of gfs2_ail1_empty (Andreas Gruenbacher) [RHEL-129363] - gfs2: don't withdraw if init_threads() got interrupted (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-129363] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix slab-use-after-free in gfs2_qd_dealloc (Andreas Gruenbacher) [RHEL-129363] {CVE-2023-52760} - gfs2: Fix asynchronous thread destruction (Andreas Gruenbacher) [RHEL-129363] - gfs2: Stop using gfs2_make_fs_ro for withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-129363] - gfs2: Turn gfs2_withdraw into a void function (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark withdraws as unlikely (Andreas Gruenbacher) [RHEL-129363] - gfs2: ignore rindex_update failure in dinode_dealloc (Andreas Gruenbacher) [RHEL-129363] - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270732] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256684] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256684] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256684] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271657] {CVE-2026-93288} - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254282] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-263292] {CVE-2026-89479} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254357] {CVE-2026-74588} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222954] {CVE-2026-52935} - powerpc/pseries: pci - logic bug (Mamatha Inamdar) [RHEL-240146] - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228} - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899] {CVE-2026-90036} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680] {CVE-2026-72262} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641} - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781] {CVE-2026-74583} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916] {CVE-2026-68377} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270905] {CVE-2026-89777} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263644] {CVE-2026-68202} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254200] {CVE-2026-80590} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233134] {CVE-2026-64572} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225459] {CVE-2026-64114} - xfs: bounds-check buffer log item's dirty bitmap (CKI Backport Bot) [RHEL-253365] {CVE-2026-80536} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234242] {CVE-2026-64266} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271288] {CVE-2026-89631} - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280060] {CVE-2026-98320} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271853] {CVE-2026-93817} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191034] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191034] {CVE-2026-53196} - gfs2: a minor finish_xmote cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor run_queue fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: only apply DLM_LKF_VALBLK if sb_lvbptr is not NULL (Alexander Aring) [RHEL-129363] - gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Use wait_event_freezable_timeout() for freezable kthread (Andreas Gruenbacher) [RHEL-129363] - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-129363] - gfs2: low-memory forced flush fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: add missing withdraw locking (Andreas Gruenbacher) [RHEL-129363] - gfs2: Disable GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename "gfs_recovery" workqueue to "gfs2_recovery" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-129363] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-129363] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify do_promote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-129363] - gfs2: introduce new gfs2_glock_assert_withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify refcounting in do_xmote (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Make recovery error more readable (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark the remaining process-independent glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark flock glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of newlines in log messages (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-129363] - gfs2: Sanitize kthread stopping (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix logd wakeup on I/O error (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_quotad (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_logd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove duplicate check in do_xmote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove space before newline (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix LM_FLAG_TRY* logic in add_to_queue (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove DLM_LKF_ALTCW / DLM_LKF_ALTPR code (Andreas Gruenbacher) [RHEL-129363] - gfs2: Further sanitize lock_dlm.c (Andreas Gruenbacher) [RHEL-129363] - gfs2: sanitize the gdlm_ast -> finish_xmote interface (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify DLM_LKF_QUECVT use (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-129363] - gfs2: Lift withdraw check out of gfs2_ail1_empty (Andreas Gruenbacher) [RHEL-129363] - gfs2: don't withdraw if init_threads() got interrupted (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-129363] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix slab-use-after-free in gfs2_qd_dealloc (Andreas Gruenbacher) [RHEL-129363] {CVE-2023-52760} - gfs2: Fix asynchronous thread destruction (Andreas Gruenbacher) [RHEL-129363] - gfs2: Stop using gfs2_make_fs_ro for withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-129363] - gfs2: Turn gfs2_withdraw into a void function (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark withdraws as unlikely (Andreas Gruenbacher) [RHEL-129363] - gfs2: ignore rindex_update failure in dinode_dealloc (Andreas Gruenbacher) [RHEL-129363] - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270732] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256684] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256684] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256684] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271657] {CVE-2026-93288} - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254282] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-263292] {CVE-2026-89479} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254357] {CVE-2026-74588} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222954] {CVE-2026-52935} - powerpc/pseries: pci - logic bug (Mamatha Inamdar) [RHEL-240146] - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228} - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899] {CVE-2026-90036} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680] {CVE-2026-72262} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641} - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781] {CVE-2026-74583} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916] {CVE-2026-68377} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - [rt] build kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 [RHEL-53529] - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071} - [rt] build kernel-rt-4.18.0-553.21.1.rt7.362.el8_10 [RHEL-53529] - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874] - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558} - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441} - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904} - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322} - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246} - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008} - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228} - [rt] build kernel-rt-4.18.0-553.20.1.rt7.361.el8_10 [RHEL-53529] - KVM: arm64: Disassociate vcpus from redistributor region on teardown (Shaoqin Huang) [RHEL-48417] {CVE-2024-40989} - devres: Fix memory leakage caused by driver API devm_free_percpu() (CKI Backport Bot) [RHEL-55597] {CVE-2024-43871} - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (Izabela Bakollari) [RHEL-26680] {CVE-2024-26600} - nvmet-fc: avoid deadlock on delete association path (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - nvmet-fc: release reference on target port (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - ACPI: LPIT: Avoid u32 multiplication overflow (Mark Langsdorf) [RHEL-37062] {CVE-2023-52683} - sched/deadline: Fix task_struct reference leak (Phil Auld) [RHEL-50904] {CVE-2024-41023} - nfsd: fix crash on LOCKT on reexported NFSv3 (Benjamin Coddington) [RHEL-31515] - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path (CKI Backport Bot) [RHEL-26570] {CVE-2024-26595} - mlxsw: spectrum_acl_tcam: Move devlink param to TCAM code (Ivan Vecera) [RHEL-26570] {CVE-2024-26595} - ACPI: extlog: fix NULL pointer dereference check (Mark Langsdorf) [RHEL-29110] {CVE-2023-52605} - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() (Mark Langsdorf) [RHEL-33198] {CVE-2024-26894} - mm: prevent derefencing NULL ptr in pfn_section_valid() (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - mm, kmsan: fix infinite recursion due to RCU critical section (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - cipso: make cipso_v4_skbuff_delattr() fully remove the CIPSO options (Ondrej Mosnacek) [RHEL-30904] - cipso: fix total option length computation (Ondrej Mosnacek) [RHEL-30904] - ext4: do not create EA inode under buffer lock (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: check the return value of ext4_xattr_inode_dec_ref() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (Carlos Maiolino) [RHEL-48507] {CVE-2024-40998} - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - [rt] build kernel-rt-4.18.0-553.19.1.rt7.360.el8_10 [RHEL-53529] - drm/i915/vma: Fix UAF on destroy against retire race (Mika Penttilä) [RHEL-35222] {CVE-2024-26939} - RHEL-48620 (Kenneth Yin) [RHEL-48620] - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (CKI Backport Bot) [RHEL-42721] {CVE-2024-26855} - net: usb: asix: do not force pause frames support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix "can't send until first packet is send" issue (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix modprobe "sysfs: cannot create duplicate filename" (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: add proper error handling of usb read errors (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix wrong return value in asix_check_host_enable() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix uninit-value in asix_mdio_read() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: fix boolconv.cocci warnings (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: do not call phy_disconnect() for ax88178 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: move embedded PHY detection as early as possible (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix uninit value bugs (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add missing stop (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: suspend PHY on driver probe (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: manage PHY PM from MAC (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: add error handling for asix_mdio_* functions (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add phylib support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: refactor asix_read_phy_addr() and handle errors on return (Ken Cox) [RHEL-28108] {CVE-2021-47101} - SUNRPC: always free ctxt when freeing deferred request (Jay Shin) [RHEL-40936] - SUNRPC: double free xprt_ctxt while still in use (Jay Shin) [RHEL-40936] - SUNRPC: Remove svc_rqst::rq_xprt_hlen (Jay Shin) [RHEL-40936] - SUNRPC: Remove dead code in svc_tcp_release_rqst() (Jay Shin) [RHEL-40936] - x86/bugs: Extend VMware Retbleed workaround to Nehalem & earlier CPUs (Waiman Long) [RHEL-48646] - wifi: iwlwifi: read txq->read_ptr under lock (Jose Ignacio Tornos Martinez) [RHEL-39797] {CVE-2024-36922} - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (John Meneghini) [RHEL-39908] {CVE-2024-36919} - nbd: always initialize struct msghdr completely (Ming Lei) [RHEL-29498] {CVE-2024-26638} - block: don't call rq_qos_ops->done_bio if the bio isn't tracked (Ming Lei) [RHEL-42151] {CVE-2021-47412} - nvmet: fix a possible leak when destroy a ctrl during qp establishment (Maurizio Lombardi) [RHEL-52013] {CVE-2024-42152} - ipv6: prevent NULL dereference in ip6_output() (Sabrina Dubroca) [RHEL-39912] {CVE-2024-36901} - ppp: reject claimed-as-LCP but actually malformed packets (Guillaume Nault) [RHEL-51052] {CVE-2024-41044} - leds: trigger: Unregister sysfs attributes before calling deactivate() (CKI Backport Bot) [RHEL-54834] {CVE-2024-43830} - crypto: bcm - Fix pointer arithmetic (cki-backport-bot) [RHEL-44108] {CVE-2024-38579} - scsi: qedf: Ensure the copied buf is NUL terminated (John Meneghini) [RHEL-44195] {CVE-2024-38559} - x86/bhi: Avoid warning in #DB handler due to BHI mitigation (Waiman Long) [RHEL-53657] {CVE-2024-42240} - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (CKI Backport Bot) [RHEL-47529] {CVE-2024-40901} - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (CKI Backport Bot) [RHEL-39843] {CVE-2024-36902} - net: usb: ax88179_178a: improve link status logs (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: improve reset check (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: fix link status when link is set to down/up (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: avoid writing the mac address before first reading (Jose Ignacio Tornos Martinez) [RHEL-45167] - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - media: cec: cec-api: add locking in cec_release() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid confusing "transmit timed out" message (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid recursive cec_claim_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: remove length check of Timer Status (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: count low-drive, error and arb-lost conditions (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add note about *_from_edid() function usage in drm (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_unconfigured() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_nb_transmit_canceled() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: don't set last_initiator if tx in progress (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: disable adapter in cec_devnode_unregister (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: not all messages were passed on when monitoring (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add support for Absolute Volume Control (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: log when claiming LA fails unexpectedly (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: drop activate_cnt, use state info instead (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: reconfigure if the PA changes during configuration (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: fix is_configuring state (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: stop trying LAs on CEC_TX_STATUS_TIMEOUT (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't unconfigure if already unconfigured (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add optional adap_configured callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add xfer_timeout_ms field (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: use call_op and check for !unregistered (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix interrupt en/disable handling (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: drop unused 'enabled' field from struct cec_pin (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix off-by-one SFT check (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: rename timer overrun variables (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: correctly pass on reply results (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: abort if the current transmit was canceled (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: call enable_adap on s_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: media/cec.h: document cec_adapter fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix a deadlock situation (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: safely unhook lists in cec_data (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: copy sequence field for the reply (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix trivial style warnings (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: add 'unregistered' checks (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't use flush_scheduled_work() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: Use fallthrough pseudo-keyword (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: remove unused waitq and phys_addrs fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: silence shift wrapping warning in __cec_s_log_addrs() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: move the core to a separate directory (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - net/iucv: Avoid explicit cpumask var allocation on stack (CKI Backport Bot) [RHEL-51631] {CVE-2024-42094} - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (Dick Kennedy) [RHEL-40400] - KVM: selftests: Make hyperv_clock require TSC based system clocksource (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Run clocksource dependent tests with hyperv_clocksource_tsc_page too (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Use generic sys_clocksource_is_tsc() in vmx_nested_tsc_scaling_test (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Generalize check_clocksource() from kvm_clock_test (Vitaly Kuznetsov) [RHEL-19027] - firmware: cs_dsp: Return error if block header overflows file (CKI Backport Bot) [RHEL-53646] {CVE-2024-42238} - firmware: cs_dsp: Validate payload length before processing block (CKI Backport Bot) [RHEL-53638] {CVE-2024-42237} - mm, slub: fix potential memoryleak in kmem_cache_open() (Waiman Long) [RHEL-38404] {CVE-2021-47466} - slub: don't panic for memcg kmem cache creation failure (Waiman Long) [RHEL-38404] {CVE-2021-47466} - wifi: ath11k: fix htt pktlog locking (Jose Ignacio Tornos Martinez) [RHEL-38317] {CVE-2023-52800} - wifi: ath11k: fix dfs radar event locking (Jose Ignacio Tornos Martinez) [RHEL-38165] {CVE-2023-52798} - lib/generic-radix-tree.c: Don't overflow in peek() (Waiman Long) [RHEL-37737] {CVE-2021-47432} - include/linux/generic-radix-tree.h: replace kernel.h with the necessary inclusions (Waiman Long) [RHEL-37737] {CVE-2021-47432} - EDAC/i10nm: Skip the absent memory controllers (Aristeu Rozanski) [RHEL-43236] - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (John Meneghini) [RHEL-38197] {CVE-2023-52809} - gfs2: Fix potential glock use-after-free on unmount (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: simplify gdlm_put_lock with out_free label (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: Remove ill-placed consistency check (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - nvme-fc: do not wait in vain when unloading module (Ewan D. Milne) [RHEL-33083] {CVE-2024-26846} - HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts (CKI Backport Bot) [RHEL-49698] {CVE-2022-48866} - scsi: qedf: Set qed_slowpath_params to zero before use (John Meneghini) [RHEL-9797] - scsi: qedf: Wait for stag work during unload (John Meneghini) [RHEL-9797] - scsi: qedf: Don't process stag work during unload and recovery (John Meneghini) [RHEL-9797] - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - mm: avoid overflows in dirty throttling logic (Audra Mitchell) [RHEL-51840] {CVE-2024-42131} - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - ACPI: fix NULL pointer dereference (Mark Langsdorf) [RHEL-37897] {CVE-2021-47289} - [rt] build kernel-rt-4.18.0-553.18.1.rt7.359.el8_10 [RHEL-53529] - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING (Ewan D. Milne) [RHEL-39805] {CVE-2024-36920} - tun: limit printing rate when illegal packet received by tun dev (Jon Maloy) [RHEL-35046] {CVE-2024-27013} - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu/mes: fix use-after-free issue (Michel Dänzer) [RHEL-44043] {CVE-2024-38581} - drm/amdgpu: Fix the null pointer when load rlc firmware (Michel Dänzer) [RHEL-30603] {CVE-2024-26649} - drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (Michel Dänzer) [RHEL-35160] {CVE-2024-27042} - net/sched: Fix UAF when resolving a clash (Xin Long) [RHEL-51014] {CVE-2024-41040} - tcp_metrics: validate source addr length (Guillaume Nault) [RHEL-52025] {CVE-2024-42154} - NFSv4/pnfs: Fix a use-after-free bug in open (Benjamin Coddington) [RHEL-35508] - NFSv4: Don't hold the layoutget locks across multiple RPC calls (Benjamin Coddington) [RHEL-35508] - scsi: qedf: Make qedf_execute_tmf() non-preemptible (John Meneghini) [RHEL-51799] {CVE-2024-42124} - Input: elantech - fix stack out of bound access in elantech_change_report_id() (CKI Backport Bot) [RHEL-41938] {CVE-2021-47097} - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (CKI Backport Bot) [RHEL-28982] {CVE-2023-52478} - drm/radeon: fix UBSAN warning in kv_dpm.c (CKI Backport Bot) [RHEL-48399] {CVE-2024-40988} - usb: core: Don't hold the device lock while sleeping in do_proc_control() (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - USB: core: Make do_proc_control() and do_proc_bulk() killable (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - scsi: qedi: Fix crash while reading debugfs attribute (CKI Backport Bot) [RHEL-48327] {CVE-2024-40978} - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CKI Backport Bot) [RHEL-48309] {CVE-2024-40977} - net: tcp: accept old ack during closing (Jamie Bainbridge) [RHEL-52433] - wifi: iwlwifi: mvm: don't read past the mfuart notifcation (CKI Backport Bot) [RHEL-48016] {CVE-2024-40941} - net/iucv: fix use after free in iucv_sock_close() (Mete Durlu) [RHEL-53988] - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (CKI Backport Bot) [RHEL-47908] {CVE-2024-40929} - Input: aiptek - properly check endpoint type (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - use descriptors of current altsetting (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - fix endpoint sanity check (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB (CKI Backport Bot) [RHEL-52373] {CVE-2024-42226} - wifi: mt76: replace skb_put with skb_put_zero (CKI Backport Bot) [RHEL-52366] {CVE-2024-42225} - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (CKI Backport Bot) [RHEL-47776] {CVE-2024-40912} - wifi: cfg80211: Lock wiphy in cfg80211_get_station (CKI Backport Bot) [RHEL-47758] {CVE-2024-40911} - VMCI: Use struct_size() in kmalloc() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() (Steve Best) [RHEL-37325] {CVE-2024-35944} - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values (Jose Ignacio Tornos Martinez) [RHEL-51761] {CVE-2024-42114} - usb: atm: cxacru: fix endpoint checking in cxacru_bind() (CKI Backport Bot) [RHEL-51442] {CVE-2024-41097} - nfs: handle error of rpc_proc_register() in init_nfs_fs() (Scott Mayhew) [RHEL-39904] {CVE-2024-36939} - drm/radeon: check bo_va->bo is non-NULL before using it (CKI Backport Bot) [RHEL-51184] {CVE-2024-41060} - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). (CKI Backport Bot) [RHEL-51027] {CVE-2024-41041} - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (CKI Backport Bot) [RHEL-50961] {CVE-2024-41035} - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). (CKI Backport Bot) [RHEL-44408] {CVE-2024-37356} - tcp: avoid too many retransmit packets (Florian Westphal) [RHEL-48627] {CVE-2024-41007} - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() (Florian Westphal) [RHEL-48627] - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Florian Westphal) [RHEL-48627] - tcp: refactor tcp_retransmit_timer() (Florian Westphal) [RHEL-48627] - tcp: exit if nothing to retransmit on RTO timeout (Florian Westphal) [RHEL-48627] - netfilter: nf_tables: Reject tables of unsupported family (Florian Westphal) [RHEL-21418] {CVE-2023-6040} - [rt] build kernel-rt-4.18.0-553.17.1.rt7.358.el8_10 [RHEL-53529] - kyber: fix out of bounds access when preempted (Ming Lei) [RHEL-27258] {CVE-2021-46984} - vfs: don't mod negative dentry count when on shrinker list (Brian Foster) [RHEL-35874] - fs/dcache: Re-use value stored to dentry->d_flags instead of re-reading (Brian Foster) [RHEL-35874] - fbmem: Do not delete the mode that is still in use (CKI Backport Bot) [RHEL-37796] {CVE-2021-47338} - netpoll: Fix race condition in netpoll_owner_active (CKI Backport Bot) [RHEL-49361] {CVE-2024-41005} - firmware: arm_scpi: Fix string overflow in SCPI genpd driver (Mark Salter) [RHEL-43702] {CVE-2021-47609} - ipv6: prevent possible NULL dereference in rt6_probe() (Guillaume Nault) [RHEL-48149] {CVE-2024-40960} - HID: i2c-hid-of: fix NULL-deref on failed power up (CKI Backport Bot) [RHEL-31598] {CVE-2024-26717} - cpufreq: amd-pstate: fix memory leak on CPU EPP exit (CKI Backport Bot) [RHEL-48489] {CVE-2024-40997} - x86/mm/pat: fix VM_PAT handling in COW mappings (Chris von Recklinghausen) [RHEL-37258] {CVE-2024-35877} - PCI/PM: Drain runtime-idle callbacks before driver removal (Myron Stowe) [RHEL-42937] {CVE-2024-35809} - PCI: Drop pci_device_remove() test of pci_dev->driver (Myron Stowe) [RHEL-42937] {CVE-2024-35809} - drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() (Mika Penttilä) [RHEL-26909] {CVE-2023-52470} - USB: core: Fix hang in usb_kill_urb by adding memory barriers (Desnes Nunes) [RHEL-43979] {CVE-2022-48760} - cifs: fix bad fids sent over wire (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB311_posix_mkdir (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB2_tcon (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB2_open (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB2_ioctl (Paulo Alcantara) [RHEL-52517] - selftests: forwarding: devlink_lib: Wait for udev events after reloading (Mark Langsdorf) [RHEL-47642] {CVE-2024-39501} - drivers: core: synchronize really_probe() and dev_uevent() (Mark Langsdorf) [RHEL-47642] {CVE-2024-39501} - udp: do not accept non-tunnel GSO skbs landing in a tunnel (Xin Long) [RHEL-42997] {CVE-2024-35884} - filelock: Remove locks reliably when fcntl/close race is detected (Bill O'Donnell) [RHEL-50170] {CVE-2024-41012} - Input: add bounds checking to input_set_capability() (Benjamin Tissoires) [RHEL-21413] {CVE-2022-48619} - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() (CKI Backport Bot) [RHEL-48130] {CVE-2024-40959} - blk-cgroup: fix list corruption from reorder of WRITE ->lqueued (Ming Lei) [RHEL-33695] - blk-cgroup: fix list corruption from resetting io stat (Ming Lei) [RHEL-33695] - net: do not leave a dangling sk pointer, when socket creation fails (CKI Backport Bot) [RHEL-48060] {CVE-2024-40954} - perf/x86/lbr: Filter vsyscall addresses (Michael Petlan) [RHEL-28991] {CVE-2023-52476} - vmci: prevent speculation leaks by sanitizing event in event_deliver() (CKI Backport Bot) [RHEL-47678] {CVE-2024-39499} - serial: core: fix transmit-buffer reset and memleak (Steve Best) [RHEL-38731] {CVE-2021-47527} - powerpc/pseries: Whitelist dtl slub object for copying to userspace (Mamatha Inamdar) [RHEL-51236] {CVE-2024-41065} - powerpc/eeh: avoid possible crash when edev->pdev changes (Mamatha Inamdar) [RHEL-51220] {CVE-2024-41064} - x86: stop playing stack games in profile_pc() (Steve Best) [RHEL-51643] {CVE-2024-42096} - mptcp: ensure snd_una is properly initialized on connect (Florian Westphal) [RHEL-47933 RHEL-47934] {CVE-2024-40931} - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet (CKI Backport Bot) [RHEL-47492] {CVE-2024-39506} - tun: add missing verification for short frame (Patrick Talbert) [RHEL-50194] {CVE-2024-41091} - tap: add missing verification for short frame (Patrick Talbert) [RHEL-50279] {CVE-2024-41090} - usb-storage: alauda: Check whether the media is initialized (Desnes Nunes) [RHEL-43708] {CVE-2024-38619} - usb-storage: alauda: Fix uninit-value in alauda_check_media() (Desnes Nunes) [RHEL-43708] {CVE-2024-38619} - hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37723] {CVE-2021-47384} - block: fix that util can be greater than 100% (Ming Lei) [RHEL-23074] - block: support to account io_ticks precisely (Ming Lei) [RHEL-23074] - watchdog: Fix possible use-after-free by calling del_timer_sync() (Steve Best) [RHEL-38795] {CVE-2021-47321} - hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37719] {CVE-2021-47385} - mlxsw: spectrum: Protect driver from buggy firmware (CKI Backport Bot) [RHEL-42245] {CVE-2021-47560} - mlxsw: Verify the accessed index doesn't exceed the array length (CKI Backport Bot) [RHEL-42245] {CVE-2021-47560} - dm: call the resume method on internal suspend (Benjamin Marzinski) [RHEL-41835] {CVE-2024-26880} - tty: Fix out-of-bound vmalloc access in imageblit (Steve Best) [RHEL-37727] {CVE-2021-47383} - hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37715] {CVE-2021-47386} - hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs (Steve Best) [RHEL-37710] {CVE-2021-47393} - nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells (Steve Best) [RHEL-38436] {CVE-2021-47497} - driver core: auxiliary bus: Fix memory leak when driver_register() fail (Steve Best) [RHEL-37901] {CVE-2021-47287} - phylib: fix potential use-after-free (cki-backport-bot) [RHEL-43764] {CVE-2022-48754} - ptp: Fix possible memory leak in ptp_clock_register() (Hangbin Liu) [RHEL-38424] {CVE-2021-47455} - NFSv4: Fix memory leak in nfs4_set_security_label (CKI Backport Bot) [RHEL-51315] {CVE-2024-41076} - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER (CKI Backport Bot) [RHEL-51618] {CVE-2024-42090} - ftruncate: pass a signed offset (CKI Backport Bot) [RHEL-51598] {CVE-2024-42084} - af_unix: Fix garbage collector racing against connect() (Felix Maurer) [RHEL-34225] {CVE-2024-26923} - virtio-net: Add validation for used length (Laurent Vivier) [RHEL-42080] {CVE-2021-47352} - net: fix possible store tearing in neigh_periodic_work() (Antoine Tenart) [RHEL-42359] {CVE-2023-52522} - tunnels: fix out of bounds access when building IPv6 PMTU error (Antoine Tenart) [RHEL-41823] {CVE-2024-26665} - vt_ioctl: fix array_index_nospec in vt_setactivate (John W. Linville) [RHEL-49141] {CVE-2022-48804} - Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() (CKI Backport Bot) [RHEL-38302] {CVE-2023-52840} - netns: Make get_net_ns() handle zero refcount net (Antoine Tenart) [RHEL-48105] {CVE-2024-40958} - tracing: Ensure visibility when inserting an element into tracing_map (Michael Petlan) [RHEL-30457] {CVE-2024-26645} - KVM: s390: fix LPSWEY handling (CKI Backport Bot) [RHEL-50072] - firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files (CKI Backport Bot) [RHEL-51144] {CVE-2024-41056} - SUNRPC: Fix a race to wake a sync task (Benjamin Coddington) [RHEL-11843] - firmware: cs_dsp: Fix overflow checking of wmfw header (CKI Backport Bot) [RHEL-50999] {CVE-2024-41039} - firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers (CKI Backport Bot) [RHEL-50987] {CVE-2024-41038} - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (Xin Long) [RHEL-48471] {CVE-2024-40995} - net: fix out-of-bounds access in ops_init (Xin Long) [RHEL-43185] {CVE-2024-36883} - x86/mce/therm_throt: Undo thermal polling properly on CPU offline (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Do not access uninitialized therm_work (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Mark throttle_active_work() as __maybe_unused (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Mask out read-only and reserved MSR bits (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Optimize notifications of thermal throttle (Steve Best) [RHEL-45310] - jiffies: add utility function to calculate delta in ms (Steve Best) [RHEL-45310] - x86/mce: Lower throttling MCE messages' priority to warning (Steve Best) [RHEL-45310] - dmaengine: idxd: Fix oops during rmmod on single-CPU platforms (Eder Zulian) [RHEL-37361] {CVE-2024-35989} - xfs: don't walk off the end of a directory data block (CKI Backport Bot) [RHEL-50879] {CVE-2024-41013} - xfs: add bounds checking to xlog_recover_process_data (CKI Backport Bot) [RHEL-50856] {CVE-2024-41014} - dm-crypt: limit the size of encryption requests (Benjamin Marzinski) [RHEL-29330] - netfilter: flowtable: remove nf_ct_l4proto_find() call (Florian Westphal) [RHEL-49589] - [rt] build kernel-rt-4.18.0-553.16.1.rt7.357.el8_10 [RHEL-44553] - x86/bhi: Fix incorrect CLEAR_BRANCH_HISTORY position in entry_INT80_compat (Waiman Long) [RHEL-50648] - [rt] build kernel-rt-4.18.0-553.15.1.rt7.356.el8_10 [RHEL-44553] - Revert "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-44613] - ionic: fix use after netif_napi_del() (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - ionic: clean interrupt before enabling queue to avoid credit race (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change (CKI Backport Bot) [RHEL-49321] {CVE-2021-47624} - xhci: Handle TD clearing for multiple streams case (CKI Backport Bot) [RHEL-47882] {CVE-2024-40927} - net: openvswitch: Fix Use-After-Free in ovs_ct_exit (cki-backport-bot) [RHEL-36362] {CVE-2024-27395} - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: fix vlan use-after-free (cki-backport-bot) [RHEL-43721] {CVE-2024-36979} - irqchip/gic-v3-its: Prevent double free on error (Charles Mirabile) [RHEL-37022] {CVE-2024-35847} - irqchip/gic-v3-its: Fix potential VPE leak on error (Charles Mirabile) [RHEL-37744] {CVE-2021-47373} - i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() (Charles Mirabile) [RHEL-34735] {CVE-2022-48632} - iommu/dma: fix zeroing of bounce buffer padding used by untrusted devices (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: remove alloc_size argument to swiotlb_tbl_map_single() (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: fix swiotlb_bounce() to do partial sync's correctly (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Reinstate page-alignment for mappings >= PAGE_SIZE (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix alignment checks when both allocation and DMA masks are present (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix double-allocation of slots due to broken alignment handling (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (cki-backport-bot) [RHEL-44441] {CVE-2024-31076} - [rt] build kernel-rt-4.18.0-553.14.1.rt7.355.el8_10 [RHEL-44553] - s390/qeth: Fix kernel panic after setting hsuid (Mete Durlu) [RHEL-49754] - perf/core: Protect event sibling list locking against interrupt inversion (Daniel Vacek) [RHEL-31798] - vt: fix unicode buffer corruption when deleting characters (Steve Best) [RHEL-36936] {CVE-2024-35823} - cifs: translate network errors on send to -ECONNABORTED (Paulo Alcantara) [RHEL-36754] - xfs: don't block in busy flushing when freeing extents (Brian Foster) [RHEL-7984] - xfs: allow extent free intents to be retried (Brian Foster) [RHEL-7984] - xfs: pass alloc flags through to xfs_extent_busy_flush() (Brian Foster) [RHEL-7984] - xfs: use deferred frees for btree block freeing (Brian Foster) [RHEL-7984] - xfs: fix bounds check in xfs_defer_agfl_block() (Brian Foster) [RHEL-7984] - xfs: validate block number being freed before adding to xefi (Brian Foster) [RHEL-7984] - xfs: rename xfs_bmap_add_free to xfs_free_extent_later (Brian Foster) [RHEL-7984] - usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (Desnes Nunes) [RHEL-36803] {CVE-2024-35790} - stm class: Fix a double free in stm_register_device() (Steve Best) [RHEL-44514] {CVE-2024-38627} - s390/qeth: Fix potential loss of L3-IP@ in case of network issues (Mete Durlu) [RHEL-49755] - tls: fix missing memory barrier in tls_init (cki-backport-bot) [RHEL-44471] {CVE-2024-36489} - xfs: fix log recovery buffer allocation for the legacy h_size fixup (Bill O'Donnell) [RHEL-46473] {CVE-2024-39472} - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: use __for_each_thread() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - exit: Use the correct exit_code in /proc/<pid>/stat (Brian Foster) [RHEL-31562] {CVE-2024-26686} - scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool (Ewan D. Milne) [RHEL-38283] {CVE-2023-52811} - scsi: qla2xxx: Fix double free of fcport (Ewan D. Milne) [RHEL-39549] {CVE-2024-26929} - scsi: qla2xxx: Fix double free of the ha->vp_map pointer (Ewan D. Milne) [RHEL-39549] {CVE-2024-26930} - scsi: qla2xxx: Fix command flush on cable pull (Ewan D. Milne) [RHEL-39549] {CVE-2024-26931} - [rt] build kernel-rt-4.18.0-553.13.1.rt7.354.el8_10 [RHEL-44553] - redhat: remove handling of deleted rhdocs/ directory from genspec.sh (Denys Vlasenko) - x86/bugs: Fix BHI retpoline check (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI handling of RRSBA (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr' (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI documentation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix return type of spectre_bhi_state() (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Make CONFIG_SPECTRE_BHI_ON the default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Mitigate KVM by default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add BHI mitigation knob (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Enumerate Branch History Injection (BHI) bug (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Define SPEC_CTRL_BHI_DIS_S (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add support for clearing branch history at syscall entry (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file (Waiman Long) [RHEL-28202] - perf/x86/amd/lbr: Use freeze based on availability (Waiman Long) [RHEL-28202] - Documentation/kernel-parameters: Add spec_rstack_overflow to mitigations=off (Waiman Long) [RHEL-28202] - KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace (Waiman Long) [RHEL-28202] - x86/bugs: Reset speculation control settings on init (Waiman Long) [RHEL-28202] - KVM: x86: Update KVM-only leaf handling to allow for 100% KVM-only leafs (Waiman Long) [RHEL-28202] - KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest (Waiman Long) [RHEL-28202] - mptcp: ensure snd_nxt is properly initialized on connect (Davide Caratti) [RHEL-39865] {CVE-2024-36889} - powerpc/pseries: Enforce hcall result buffer validity and size (Mamatha Inamdar) [RHEL-48291] {CVE-2024-40974} - wifi: mac80211: fix potential key use-after-free (Jose Ignacio Tornos Martinez) [RHEL-28007] {CVE-2023-52530} - cppc_cpufreq: Fix possible null pointer dereference (Mark Langsdorf) [RHEL-44137] {CVE-2024-38573} - net/sched: act_mirred: use the backlog for mirred ingress (Davide Caratti) [RHEL-31718] {CVE-2024-26740} - vfio/pci: Lock external INTx masking ops (Alex Williamson) [RHEL-31922] {CVE-2024-26810} - net: sched: sch_multiq: fix possible OOB write in multiq_tune() (Davide Caratti) [RHEL-43464] {CVE-2024-36978} - tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized (Guillaume Nault) [RHEL-37850] {CVE-2021-47304} - pstore/ram: Fix crash when setting number of cpus to an odd number (Lenny Szubowicz) [RHEL-29471] {CVE-2023-52619} - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node (Jocelyn Falempe) [RHEL-37101] {CVE-2023-52662} - drm/vmwgfx: Fix the lifetime of the bo cursor memory (Jocelyn Falempe) [RHEL-36962] {CVE-2024-35810} - drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed (Jocelyn Falempe) [RHEL-34987] {CVE-2024-26940} - drm/vmwgfx: Unmap the surface before resetting it on a plane state (Jocelyn Falempe) [RHEL-35217] {CVE-2023-52648} - drm/vmwgfx: Fix invalid reads in fence signaled events (Jocelyn Falempe) [RHEL-40010] {CVE-2024-36960} - block: Fix wrong offset in bio_truncate() (Ming Lei) [RHEL-43782] {CVE-2022-48747} - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CKI Backport Bot) [RHEL-46913] {CVE-2024-39487} - net: fix __dst_negative_advice() race (Xin Long) [RHEL-41183] {CVE-2024-36971} - igc: avoid returning frame twice in XDP_REDIRECT (Corinna Vinschen) [RHEL-33264] {CVE-2024-26853} - mac802154: fix llsec key resources release in mac802154_llsec_key_del (Steve Best) [RHEL-34967] {CVE-2024-26961} - cpufreq: exit() callback is optional (Mark Langsdorf) [RHEL-43840] {CVE-2024-38615} - cifs: prevent infinite recursion in CIFSGetDFSRefer() (Paulo Alcantara) [RHEL-34672] - cifs: lock chan_lock outside match_session (Paulo Alcantara) [RHEL-34672] - smb3: workaround negprot bug in some Samba servers (Paulo Alcantara) [RHEL-34672] - smb3: use netname when available on secondary channels (Paulo Alcantara) [RHEL-34672] - smb3: fix empty netname context on secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: populate empty hostnames for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: always iterate smb sessions using primary channel (Paulo Alcantara) [RHEL-34672] - cifs: Fix connections leak when tlink setup failed (Paulo Alcantara) [RHEL-34672] - cifs: Fix memory leak when build ntlmssp negotiate blob failed (Paulo Alcantara) [RHEL-34672] - cifs: always initialize struct msghdr smb_msg completely (Paulo Alcantara) [RHEL-34672] - cifs: don't send down the destination address to sendmsg for a SOCK_STREAM (Paulo Alcantara) [RHEL-34672] - cifs: revalidate mapping when doing direct writes (Paulo Alcantara) [RHEL-34672] - cifs: skip extra NULL byte in filenames (Paulo Alcantara) [RHEL-34672] - cifs: list_for_each() -> list_for_each_entry() (Paulo Alcantara) [RHEL-34672] - smb2: small refactor in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - cifs: Fix crash on unload of cifs_arc4.ko (Paulo Alcantara) [RHEL-34672] - cifs: remove check of list iterator against head past the loop body (Paulo Alcantara) [RHEL-34672] - cifs: fix reconnect on smb3 mount types (Paulo Alcantara) [RHEL-34672] - cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (Paulo Alcantara) [RHEL-34672] - cifs: skip trailing separators of prefix paths (Paulo Alcantara) [RHEL-34672] - cifs: fix ntlmssp on old servers (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL ptr dereference in refresh_mounts() (Paulo Alcantara) [RHEL-34672] - cifs: do not skip link targets when an I/O fails (Paulo Alcantara) [RHEL-34672] - cifs: fix confusing unneeded warning message on smb2.1 and earlier (Paulo Alcantara) [RHEL-34672] - smb3: fix snapshot mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix workstation_name for multiuser mounts (Paulo Alcantara) [RHEL-34672] - cifs: alloc_path_with_tree_prefix: do not append sep. if the path is empty (Paulo Alcantara) [RHEL-34672] - cifs: free ntlmsspblob allocated in negotiate (Paulo Alcantara) [RHEL-34672] - cifs: avoid use of dstaddr as key for fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: add server conn_id to fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: fix missed refcounting of ipc tcon (Paulo Alcantara) [RHEL-34672] - smb2: clarify rc initialization in smb2_reconnect (Paulo Alcantara) [RHEL-34672] - cifs: populate server_hostname for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should be set on new server (Paulo Alcantara) [RHEL-34672] - cifs: introduce cifs_ses_mark_for_reconnect() helper (Paulo Alcantara) [RHEL-34672] - cifs: protect srv_count with cifs_tcp_ses_lock (Paulo Alcantara) [RHEL-34672] - cifs: move debug print out of spinlock (Paulo Alcantara) [RHEL-34672] - cifs: do not duplicate fscache cookie for secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: connect individual channel servers to primary channel server (Paulo Alcantara) [RHEL-34672] - cifs: protect session channel fields with chan_lock (Paulo Alcantara) [RHEL-34672] - cifs: do not negotiate session if session already exists (Paulo Alcantara) [RHEL-34672] - smb3: do not setup the fscache_super_cookie until fsinfo initialized (Paulo Alcantara) [RHEL-34672] - cifs: fix potential use-after-free bugs (Paulo Alcantara) [RHEL-34672] - cifs: release lock earlier in dequeue_mid error case (Paulo Alcantara) [RHEL-34672] - smb3: remove trivial dfs compile warning (Paulo Alcantara) [RHEL-34672] - cifs: support nested dfs links over reconnect (Paulo Alcantara) [RHEL-34672] - cifs: for compound requests, use open handle if possible (Paulo Alcantara) [RHEL-34672] - cifs: split out dfs code from cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant (Paulo Alcantara) [RHEL-34672] - cifs: introduce new helper for cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: fix print of hdr_flags in dfscache_proc_show() (Paulo Alcantara) [RHEL-34672] - cifs: send workstation name during ntlmssp session setup (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should not share socket with future sessions (Paulo Alcantara) [RHEL-34672] - smb3: add dynamic trace points for socket connection (Paulo Alcantara) [RHEL-34672] - cifs: Move SMB2_Create definitions to the shared area (Paulo Alcantara) [RHEL-34672] - cifs: Move more definitions into the shared area (Paulo Alcantara) [RHEL-34672] - cifs: move NEGOTIATE_PROTOCOL definitions out into the common area (Paulo Alcantara) [RHEL-34672] - cifs: Create a new shared file holding smb2 pdu definitions (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect check for null pointer in header_assemble (Paulo Alcantara) [RHEL-34672] - smb3: correct server pointer dereferencing check to be more consistent (Paulo Alcantara) [RHEL-34672] - cifs: Deal with some warnings from W=1 (Paulo Alcantara) [RHEL-34672] - cifs: fix a sign extension bug (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect kernel doc comments (Paulo Alcantara) [RHEL-34672] - cifs: remove pathname for file from SPDX header (Paulo Alcantara) [RHEL-34672] - cifs: move SMB FSCTL definitions to common code (Paulo Alcantara) [RHEL-34672] - cifs: rename cifs_common to smbfs_common (Paulo Alcantara) [RHEL-34672] - cifs: update FSCTL definitions (Paulo Alcantara) [RHEL-34672] - cifs: cifs_md4 convert to SPDX identifier (Paulo Alcantara) [RHEL-34672] - cifs: create a MD4 module and switch cifs.ko to use it (Paulo Alcantara) [RHEL-34672] - cifs: fork arc4 and create a separate module for it for cifs and other users (Paulo Alcantara) [RHEL-34672] - smb3: fix posix extensions mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix wrong release in sess_alloc_buffer() failed path (Paulo Alcantara) [RHEL-34672] - CIFS: Fix a potencially linear read overflow (Paulo Alcantara) [RHEL-34672] - cifs: use the correct max-length for dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: create sd context must be a multiple of 8 (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp sessions of dfs connections (Paulo Alcantara) [RHEL-34672] - cifs: added WARN_ON for all the count decrements (Paulo Alcantara) [RHEL-34672] - cifs: fix missing null session check in mount (Paulo Alcantara) [RHEL-34672] - cifs: handle reconnect of tcon when there is no cached dfs referral (Paulo Alcantara) [RHEL-34672] - cifs: fix the out of range assignment to bit fields in parse_server_interfaces (Paulo Alcantara) [RHEL-34672] - smb3: fix typo in header file (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: Add support for negotiating signing algorithm (Paulo Alcantara) [RHEL-34672] - cifs: prevent NULL deref in cifs_compose_mount_options() (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL dereference in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - smbdirect: missing rc checks while waiting for rdma events (Paulo Alcantara) [RHEL-34672] - cifs: Avoid field over-reading memcpy() (Paulo Alcantara) [RHEL-34672] - smb311: remove dead code for non compounded posix query info (Paulo Alcantara) [RHEL-34672] - cifs: fix SMB1 error path in cifs_get_file_info_unix (Paulo Alcantara) [RHEL-34672] - smb3: fix uninitialized value for port in witness protocol move (Paulo Alcantara) [RHEL-34672] - cifs: fix unneeded null check (Paulo Alcantara) [RHEL-34672] - cifs: use SPDX-Licence-Identifier (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in cifs_debug.c (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in smb2misc.c (Paulo Alcantara) [RHEL-34672] - cifs: missed ref-counting smb session in find (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp servers with dfs mounts (Paulo Alcantara) [RHEL-34672] - cifs: set a minimum of 2 minutes for refreshing dfs cache (Paulo Alcantara) [RHEL-34672] - cifs: Remove unused inline function is_sysvol_or_netlogon() (Paulo Alcantara) [RHEL-34672] - cifs: remove duplicated prototype (Paulo Alcantara) [RHEL-34672] - cifs: fix ipv6 formating in cifs_ses_add_channel (Paulo Alcantara) [RHEL-34672] - cifs: fix string declarations and assignments in tracepoints (Paulo Alcantara) [RHEL-34672] - cifs: fix memory leak in smb2_copychunk_range (Paulo Alcantara) [RHEL-34672] - SMB3: incorrect file id in requests compounded with open (Paulo Alcantara) [RHEL-34672] - smb3: if max_channels set to more than one channel request multichannel (Paulo Alcantara) [RHEL-34672] - smb3: do not attempt multichannel to server which does not support it (Paulo Alcantara) [RHEL-34672] - smb3: when mounting with multichannel include it in requested capabilities (Paulo Alcantara) [RHEL-34672] - cifs: simplify SWN code with dummy funcs instead of ifdefs (Paulo Alcantara) [RHEL-34672] - cifs: log mount errors using cifs_errorf() (Paulo Alcantara) [RHEL-34672] - cifs: switch build_path_from_dentry() to using dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: fix out-of-bound memory access when calling smb3_notify() at mount point (Paulo Alcantara) [RHEL-34672] - cifs: allocate buffer in the caller of build_path_from_dentry() (Paulo Alcantara) [RHEL-34672] - cifs: make build_path_from_dentry() return const char * (Paulo Alcantara) [RHEL-34672] - cifs: remove old dead code (Paulo Alcantara) [RHEL-34672] - fs: cifs: Remove repeated struct declaration (Paulo Alcantara) [RHEL-34672] - cifs: have cifs_fattr_to_inode() refuse to change type on live inode (Paulo Alcantara) [RHEL-34672] - cifs: have ->mkdir() handle race with another client sanely (Paulo Alcantara) [RHEL-34672] - do_cifs_create(): don't set ->i_mode of something we had not created (Paulo Alcantara) [RHEL-34672] - cifs: Silently ignore unknown oplock break handle (Paulo Alcantara) [RHEL-34672] - cifs: change noisy error message to FYI (Paulo Alcantara) [RHEL-34672] - cifs: print MIDs in decimal notation (Paulo Alcantara) [RHEL-34672] - cifs: minor simplification to smb2_is_network_name_deleted (Paulo Alcantara) [RHEL-34672] - TCON Reconnect during STATUS_NETWORK_NAME_DELETED (Paulo Alcantara) [RHEL-34672] - cifs: clarify hostname vs ip address in /proc/fs/cifs/DebugData (Paulo Alcantara) [RHEL-34672] - cifs: change confusing field serverName (to ip_addr) (Paulo Alcantara) [RHEL-34672] - cifs: Reformat DebugData and index connections by conn_id. (Paulo Alcantara) [RHEL-34672] - cifs: Identify a connection by a conn_id. (Paulo Alcantara) [RHEL-34672] - smb3: negotiate current dialect (SMB3.1.1) when version 3 or greater requested (Paulo Alcantara) [RHEL-34672] - smb3: Fix out-of-bounds bug in SMB2_negotiate() (Paulo Alcantara) [RHEL-34672] - fs/cifs: Simplify bool comparison. (Paulo Alcantara) [RHEL-34672] - fs/cifs: Assign boolean values to a bool variable (Paulo Alcantara) [RHEL-34672] - cifs: Avoid error pointer dereference (Paulo Alcantara) [RHEL-34672] - cifs: Re-indent cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Unlock on errors in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Delete a stray unlock in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Tracepoints and logs for tracing credit changes. (Paulo Alcantara) [RHEL-34672] - cifs: Fix some error pointers handling detected by static checker (Paulo Alcantara) [RHEL-34672] - smb3: remind users that witness protocol is experimental (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: do not log warning message if server doesn't populate salt (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: update comments clarifying SPNEGO info in negprot response (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot rsp (Paulo Alcantara) [RHEL-34672] - SMB3: avoid confusing warning message on mount to Azure (Paulo Alcantara) [RHEL-34672] - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (Nigel Croxon) [RHEL-46662] {CVE-2024-39476} - net: fix information leakage in /proc/net/ptype (Hangbin Liu) [RHEL-44000] {CVE-2022-48757} - usb: typec: ucsi: Limit read size on v1.2 (Desnes Nunes) [RHEL-37286] {CVE-2024-35924} - minmax: relax check to allow comparison between unsigned arguments and signed constants (Desnes Nunes) [RHEL-37286] - minmax: allow comparisons of 'int' against 'unsigned char/short' (Desnes Nunes) [RHEL-37286] - minmax: allow min()/max()/clamp() if the arguments have the same signedness. (Desnes Nunes) [RHEL-37286] - minmax: add umin(a, b) and umax(a, b) (Desnes Nunes) [RHEL-37286] - minmax: fix header inclusions (Desnes Nunes) [RHEL-37286] - minmax: clamp more efficiently by avoiding extra comparison (Desnes Nunes) [RHEL-37286] - minmax: sanity check constant bounds when clamping (Desnes Nunes) [RHEL-37286] - tracing: Define the is_signed_type() macro once (Desnes Nunes) [RHEL-37286] - linux/bits.h: fix compilation error with GENMASK (Desnes Nunes) [RHEL-37286] - x86/apic: Mask IOAPIC entries when disabling the local APIC (Lenny Szubowicz) [RHEL-18077] - userfaultfd: fix a race between writeprotect and exit_mmap() (Rafael Aquini) [RHEL-38410] {CVE-2021-47461} - mm: khugepaged: skip huge page collapse for special files (Waiman Long) [RHEL-38446] {CVE-2021-47491} - cachefiles: fix memory leak in cachefiles_add_cache() (Andrey Albershteyn) [RHEL-33109] {CVE-2024-26840} - drm/amd/display: Implement bounds check for stream encoder creation in DCN301 (Michel Dänzer) [RHEL-31429] {CVE-2024-26660} - net/mlx5: Discard command completions in internal error (Kamal Heib) [RHEL-44231] {CVE-2024-38555} - drm: Don't unref the same fb many times by mistake due to deadlock handling (CKI Backport Bot) [RHEL-29011] {CVE-2023-52486} - md: fix resync softlockup when bitmap size is less than array size (Nigel Croxon) [RHEL-43942] {CVE-2024-38598} - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation (Davide Caratti) [RHEL-39712] {CVE-2024-36017} - netfilter: nf_tables: discard table flag update with pending basechain deletion (Phil Sutter) [RHEL-37205] {CVE-2024-35897} - netfilter: nf_tables: reject table flag and netdev basechain updates (Phil Sutter) [RHEL-37205] - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (Ewan D. Milne) [RHEL-40172] {CVE-2024-36924} - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (Ewan D. Milne) [RHEL-40172] {CVE-2024-36952} - netfilter: nf_tables: fix memleak in map from abort path (Phil Sutter) [RHEL-35052] {CVE-2024-27011} - netfilter: nf_tables: reject new basechain after table flag update (Phil Sutter) [RHEL-37193] {CVE-2024-35900} - netfilter: nf_tables: flush pending destroy work before exit_net release (Phil Sutter) [RHEL-37197] {CVE-2024-35899} - netfilter: complete validation of user input (Phil Sutter) [RHEL-37210] - netfilter: validate user input for expected length (Phil Sutter) [RHEL-37210] {CVE-2024-35896} - netfilter: tproxy: bail out if IP has been disabled on the device (Phil Sutter) [RHEL-44363] {CVE-2024-36270} - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (Phil Sutter) [RHEL-44532] {CVE-2024-36286} - netfilter: nf_tables: do not compare internal table flags on updates (Phil Sutter) [RHEL-35114] {CVE-2024-27065} - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (Phil Sutter) [RHEL-35028] {CVE-2024-27019} - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (Phil Sutter) [RHEL-35024] {CVE-2024-27020} - netfilter: nf_tables: __nft_expr_type_get() selects specific family type (Phil Sutter) [RHEL-35024] - netfilter: conntrack: serialize hash resizes and cleanups (Phil Sutter) [RHEL-37703] {CVE-2021-47408} - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (Phil Sutter) [RHEL-34217] {CVE-2024-26925} - netfilter: nf_tables: release batch on table validation from abort path (Phil Sutter) [RHEL-34217] - ipvlan: add ipvlan_route_v6_outbound() helper (Davide Caratti) [RHEL-38319] {CVE-2023-52796} - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.23.1.rt7.364.el8_10 [RHEL-59541] - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002] - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924} - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042} - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070} - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898} - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301} - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976} - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540} - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284} - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857} - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924} - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983} - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854} - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936} - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093} - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961} - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880} - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244} - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984} - [rt] build kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 [RHEL-53529] - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071} - [rt] build kernel-rt-4.18.0-553.21.1.rt7.362.el8_10 [RHEL-53529] - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874] - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558} - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441} - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904} - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322} - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246} - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008} - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228} - [rt] build kernel-rt-4.18.0-553.20.1.rt7.361.el8_10 [RHEL-53529] - KVM: arm64: Disassociate vcpus from redistributor region on teardown (Shaoqin Huang) [RHEL-48417] {CVE-2024-40989} - devres: Fix memory leakage caused by driver API devm_free_percpu() (CKI Backport Bot) [RHEL-55597] {CVE-2024-43871} - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (Izabela Bakollari) [RHEL-26680] {CVE-2024-26600} - nvmet-fc: avoid deadlock on delete association path (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - nvmet-fc: release reference on target port (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - ACPI: LPIT: Avoid u32 multiplication overflow (Mark Langsdorf) [RHEL-37062] {CVE-2023-52683} - sched/deadline: Fix task_struct reference leak (Phil Auld) [RHEL-50904] {CVE-2024-41023} - nfsd: fix crash on LOCKT on reexported NFSv3 (Benjamin Coddington) [RHEL-31515] - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path (CKI Backport Bot) [RHEL-26570] {CVE-2024-26595} - mlxsw: spectrum_acl_tcam: Move devlink param to TCAM code (Ivan Vecera) [RHEL-26570] {CVE-2024-26595} - ACPI: extlog: fix NULL pointer dereference check (Mark Langsdorf) [RHEL-29110] {CVE-2023-52605} - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() (Mark Langsdorf) [RHEL-33198] {CVE-2024-26894} - mm: prevent derefencing NULL ptr in pfn_section_valid() (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - mm, kmsan: fix infinite recursion due to RCU critical section (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - cipso: make cipso_v4_skbuff_delattr() fully remove the CIPSO options (Ondrej Mosnacek) [RHEL-30904] - cipso: fix total option length computation (Ondrej Mosnacek) [RHEL-30904] - ext4: do not create EA inode under buffer lock (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: check the return value of ext4_xattr_inode_dec_ref() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (Carlos Maiolino) [RHEL-48507] {CVE-2024-40998} - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - [rt] build kernel-rt-4.18.0-553.19.1.rt7.360.el8_10 [RHEL-53529] - drm/i915/vma: Fix UAF on destroy against retire race (Mika Penttilä) [RHEL-35222] {CVE-2024-26939} - RHEL-48620 (Kenneth Yin) [RHEL-48620] - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (CKI Backport Bot) [RHEL-42721] {CVE-2024-26855} - net: usb: asix: do not force pause frames support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix "can't send until first packet is send" issue (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix modprobe "sysfs: cannot create duplicate filename" (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: add proper error handling of usb read errors (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix wrong return value in asix_check_host_enable() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix uninit-value in asix_mdio_read() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: fix boolconv.cocci warnings (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: do not call phy_disconnect() for ax88178 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: move embedded PHY detection as early as possible (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix uninit value bugs (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add missing stop (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: suspend PHY on driver probe (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: manage PHY PM from MAC (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: add error handling for asix_mdio_* functions (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add phylib support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: refactor asix_read_phy_addr() and handle errors on return (Ken Cox) [RHEL-28108] {CVE-2021-47101} - SUNRPC: always free ctxt when freeing deferred request (Jay Shin) [RHEL-40936] - SUNRPC: double free xprt_ctxt while still in use (Jay Shin) [RHEL-40936] - SUNRPC: Remove svc_rqst::rq_xprt_hlen (Jay Shin) [RHEL-40936] - SUNRPC: Remove dead code in svc_tcp_release_rqst() (Jay Shin) [RHEL-40936] - x86/bugs: Extend VMware Retbleed workaround to Nehalem & earlier CPUs (Waiman Long) [RHEL-48646] - wifi: iwlwifi: read txq->read_ptr under lock (Jose Ignacio Tornos Martinez) [RHEL-39797] {CVE-2024-36922} - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (John Meneghini) [RHEL-39908] {CVE-2024-36919} - nbd: always initialize struct msghdr completely (Ming Lei) [RHEL-29498] {CVE-2024-26638} - block: don't call rq_qos_ops->done_bio if the bio isn't tracked (Ming Lei) [RHEL-42151] {CVE-2021-47412} - nvmet: fix a possible leak when destroy a ctrl during qp establishment (Maurizio Lombardi) [RHEL-52013] {CVE-2024-42152} - ipv6: prevent NULL dereference in ip6_output() (Sabrina Dubroca) [RHEL-39912] {CVE-2024-36901} - ppp: reject claimed-as-LCP but actually malformed packets (Guillaume Nault) [RHEL-51052] {CVE-2024-41044} - leds: trigger: Unregister sysfs attributes before calling deactivate() (CKI Backport Bot) [RHEL-54834] {CVE-2024-43830} - crypto: bcm - Fix pointer arithmetic (cki-backport-bot) [RHEL-44108] {CVE-2024-38579} - scsi: qedf: Ensure the copied buf is NUL terminated (John Meneghini) [RHEL-44195] {CVE-2024-38559} - x86/bhi: Avoid warning in #DB handler due to BHI mitigation (Waiman Long) [RHEL-53657] {CVE-2024-42240} - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (CKI Backport Bot) [RHEL-47529] {CVE-2024-40901} - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (CKI Backport Bot) [RHEL-39843] {CVE-2024-36902} - net: usb: ax88179_178a: improve link status logs (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: improve reset check (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: fix link status when link is set to down/up (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: avoid writing the mac address before first reading (Jose Ignacio Tornos Martinez) [RHEL-45167] - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - media: cec: cec-api: add locking in cec_release() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid confusing "transmit timed out" message (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid recursive cec_claim_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: remove length check of Timer Status (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: count low-drive, error and arb-lost conditions (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add note about *_from_edid() function usage in drm (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_unconfigured() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_nb_transmit_canceled() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: don't set last_initiator if tx in progress (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: disable adapter in cec_devnode_unregister (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: not all messages were passed on when monitoring (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add support for Absolute Volume Control (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: log when claiming LA fails unexpectedly (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: drop activate_cnt, use state info instead (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: reconfigure if the PA changes during configuration (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: fix is_configuring state (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: stop trying LAs on CEC_TX_STATUS_TIMEOUT (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't unconfigure if already unconfigured (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add optional adap_configured callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add xfer_timeout_ms field (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: use call_op and check for !unregistered (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix interrupt en/disable handling (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: drop unused 'enabled' field from struct cec_pin (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix off-by-one SFT check (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: rename timer overrun variables (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: correctly pass on reply results (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: abort if the current transmit was canceled (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: call enable_adap on s_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: media/cec.h: document cec_adapter fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix a deadlock situation (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: safely unhook lists in cec_data (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: copy sequence field for the reply (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix trivial style warnings (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: add 'unregistered' checks (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't use flush_scheduled_work() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: Use fallthrough pseudo-keyword (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: remove unused waitq and phys_addrs fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: silence shift wrapping warning in __cec_s_log_addrs() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: move the core to a separate directory (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - net/iucv: Avoid explicit cpumask var allocation on stack (CKI Backport Bot) [RHEL-51631] {CVE-2024-42094} - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (Dick Kennedy) [RHEL-40400] - KVM: selftests: Make hyperv_clock require TSC based system clocksource (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Run clocksource dependent tests with hyperv_clocksource_tsc_page too (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Use generic sys_clocksource_is_tsc() in vmx_nested_tsc_scaling_test (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Generalize check_clocksource() from kvm_clock_test (Vitaly Kuznetsov) [RHEL-19027] - firmware: cs_dsp: Return error if block header overflows file (CKI Backport Bot) [RHEL-53646] {CVE-2024-42238} - firmware: cs_dsp: Validate payload length before processing block (CKI Backport Bot) [RHEL-53638] {CVE-2024-42237} - mm, slub: fix potential memoryleak in kmem_cache_open() (Waiman Long) [RHEL-38404] {CVE-2021-47466} - slub: don't panic for memcg kmem cache creation failure (Waiman Long) [RHEL-38404] {CVE-2021-47466} - wifi: ath11k: fix htt pktlog locking (Jose Ignacio Tornos Martinez) [RHEL-38317] {CVE-2023-52800} - wifi: ath11k: fix dfs radar event locking (Jose Ignacio Tornos Martinez) [RHEL-38165] {CVE-2023-52798} - lib/generic-radix-tree.c: Don't overflow in peek() (Waiman Long) [RHEL-37737] {CVE-2021-47432} - include/linux/generic-radix-tree.h: replace kernel.h with the necessary inclusions (Waiman Long) [RHEL-37737] {CVE-2021-47432} - EDAC/i10nm: Skip the absent memory controllers (Aristeu Rozanski) [RHEL-43236] - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (John Meneghini) [RHEL-38197] {CVE-2023-52809} - gfs2: Fix potential glock use-after-free on unmount (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: simplify gdlm_put_lock with out_free label (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: Remove ill-placed consistency check (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - nvme-fc: do not wait in vain when unloading module (Ewan D. Milne) [RHEL-33083] {CVE-2024-26846} - HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts (CKI Backport Bot) [RHEL-49698] {CVE-2022-48866} - scsi: qedf: Set qed_slowpath_params to zero before use (John Meneghini) [RHEL-9797] - scsi: qedf: Wait for stag work during unload (John Meneghini) [RHEL-9797] - scsi: qedf: Don't process stag work during unload and recovery (John Meneghini) [RHEL-9797] - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - mm: avoid overflows in dirty throttling logic (Audra Mitchell) [RHEL-51840] {CVE-2024-42131} - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - ACPI: fix NULL pointer dereference (Mark Langsdorf) [RHEL-37897] {CVE-2021-47289} - [rt] build kernel-rt-4.18.0-553.18.1.rt7.359.el8_10 [RHEL-53529] - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING (Ewan D. Milne) [RHEL-39805] {CVE-2024-36920} - tun: limit printing rate when illegal packet received by tun dev (Jon Maloy) [RHEL-35046] {CVE-2024-27013} - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu/mes: fix use-after-free issue (Michel Dänzer) [RHEL-44043] {CVE-2024-38581} - drm/amdgpu: Fix the null pointer when load rlc firmware (Michel Dänzer) [RHEL-30603] {CVE-2024-26649} - drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (Michel Dänzer) [RHEL-35160] {CVE-2024-27042} - net/sched: Fix UAF when resolving a clash (Xin Long) [RHEL-51014] {CVE-2024-41040} - tcp_metrics: validate source addr length (Guillaume Nault) [RHEL-52025] {CVE-2024-42154} - NFSv4/pnfs: Fix a use-after-free bug in open (Benjamin Coddington) [RHEL-35508] - NFSv4: Don't hold the layoutget locks across multiple RPC calls (Benjamin Coddington) [RHEL-35508] - scsi: qedf: Make qedf_execute_tmf() non-preemptible (John Meneghini) [RHEL-51799] {CVE-2024-42124} - Input: elantech - fix stack out of bound access in elantech_change_report_id() (CKI Backport Bot) [RHEL-41938] {CVE-2021-47097} - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (CKI Backport Bot) [RHEL-28982] {CVE-2023-52478} - drm/radeon: fix UBSAN warning in kv_dpm.c (CKI Backport Bot) [RHEL-48399] {CVE-2024-40988} - usb: core: Don't hold the device lock while sleeping in do_proc_control() (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - USB: core: Make do_proc_control() and do_proc_bulk() killable (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - scsi: qedi: Fix crash while reading debugfs attribute (CKI Backport Bot) [RHEL-48327] {CVE-2024-40978} - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CKI Backport Bot) [RHEL-48309] {CVE-2024-40977} - net: tcp: accept old ack during closing (Jamie Bainbridge) [RHEL-52433] - wifi: iwlwifi: mvm: don't read past the mfuart notifcation (CKI Backport Bot) [RHEL-48016] {CVE-2024-40941} - net/iucv: fix use after free in iucv_sock_close() (Mete Durlu) [RHEL-53988] - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (CKI Backport Bot) [RHEL-47908] {CVE-2024-40929} - Input: aiptek - properly check endpoint type (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - use descriptors of current altsetting (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - fix endpoint sanity check (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB (CKI Backport Bot) [RHEL-52373] {CVE-2024-42226} - wifi: mt76: replace skb_put with skb_put_zero (CKI Backport Bot) [RHEL-52366] {CVE-2024-42225} - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (CKI Backport Bot) [RHEL-47776] {CVE-2024-40912} - wifi: cfg80211: Lock wiphy in cfg80211_get_station (CKI Backport Bot) [RHEL-47758] {CVE-2024-40911} - VMCI: Use struct_size() in kmalloc() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() (Steve Best) [RHEL-37325] {CVE-2024-35944} - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values (Jose Ignacio Tornos Martinez) [RHEL-51761] {CVE-2024-42114} - usb: atm: cxacru: fix endpoint checking in cxacru_bind() (CKI Backport Bot) [RHEL-51442] {CVE-2024-41097} - nfs: handle error of rpc_proc_register() in init_nfs_fs() (Scott Mayhew) [RHEL-39904] {CVE-2024-36939} - drm/radeon: check bo_va->bo is non-NULL before using it (CKI Backport Bot) [RHEL-51184] {CVE-2024-41060} - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). (CKI Backport Bot) [RHEL-51027] {CVE-2024-41041} - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (CKI Backport Bot) [RHEL-50961] {CVE-2024-41035} - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). (CKI Backport Bot) [RHEL-44408] {CVE-2024-37356} - tcp: avoid too many retransmit packets (Florian Westphal) [RHEL-48627] {CVE-2024-41007} - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() (Florian Westphal) [RHEL-48627] - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Florian Westphal) [RHEL-48627] - tcp: refactor tcp_retransmit_timer() (Florian Westphal) [RHEL-48627] - tcp: exit if nothing to retransmit on RTO timeout (Florian Westphal) [RHEL-48627] - netfilter: nf_tables: Reject tables of unsupported family (Florian Westphal) [RHEL-21418] {CVE-2023-6040} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.23.1.rt7.364.el8_10 [RHEL-59541] - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002] - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924} - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042} - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070} - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898} - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301} - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976} - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540} - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284} - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857} - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924} - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983} - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854} - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936} - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093} - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961} - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880} - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244} - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984} - [rt] build kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 [RHEL-53529] - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071} - [rt] build kernel-rt-4.18.0-553.21.1.rt7.362.el8_10 [RHEL-53529] - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874] - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558} - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441} - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904} - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322} - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246} - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008} - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228} - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.23.1.rt7.364.el8_10 [RHEL-59541] - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002] - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924} - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042} - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070} - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898} - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301} - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976} - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540} - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284} - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857} - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924} - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983} - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854} - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936} - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093} - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961} - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880} - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244} - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - [rt] build kernel-rt-4.18.0-553.35.1.rt7.376.el8_10 [RHEL-72569] - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480] - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480] - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396] - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - [rt] build kernel-rt-4.18.0-553.35.1.rt7.376.el8_10 [RHEL-72569] - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480] - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480] - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396] - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - [rt] build kernel-rt-4.18.0-553.35.1.rt7.376.el8_10 [RHEL-72569] - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480] - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480] - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396] - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.5.1.rt7.346.el8_10 [RHEL-34640] - tools/power/turbostat: Fix uncore frequency file string (David Arcari) [RHEL-29238] - tools/power turbostat: Expand probe_intel_uncore_frequency() (David Arcari) [RHEL-29238] - uio: Fix use-after-free in uio_open (Ricardo Robaina) [RHEL-26232] {CVE-2023-52439} - net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (Ken Cox) [RHEL-27316] {CVE-2021-47013} - keys: Fix linking a duplicate key to a keyring's assoc_array (David Howells) [RHEL-30772] - keys: Hoist locking out of __key_link_begin() (David Howells) [RHEL-30772] - keys: Break bits out of key_unlink() (David Howells) [RHEL-30772] - keys: Change keyring_serialise_link_sem to a mutex (David Howells) [RHEL-30772] - wifi: brcm80211: handle pmk_op allocation failure (Jose Ignacio Tornos Martinez) [RHEL-35150] {CVE-2024-27048} - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work (Jose Ignacio Tornos Martinez) [RHEL-35140] {CVE-2024-27052} - wifi: iwlwifi: mvm: ensure offloading TID queue exists (Jose Ignacio Tornos Martinez) [RHEL-35130] {CVE-2024-27056} - wifi: mt76: mt7921e: fix use-after-free in free_irq() (Jose Ignacio Tornos Martinez) [RHEL-34866] {CVE-2024-26892} - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete (Jose Ignacio Tornos Martinez) [RHEL-34189] {CVE-2024-26897} - wifi: iwlwifi: mvm: fix a crash when we run out of stations (Jose Ignacio Tornos Martinez) [RHEL-31547] {CVE-2024-26693} - wifi: iwlwifi: fix double-free bug (Jose Ignacio Tornos Martinez) [RHEL-31543] {CVE-2024-26694} - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (Jose Ignacio Tornos Martinez) [RHEL-29089] {CVE-2023-52594} - wifi: rt2x00: restart beacon queue when hardware reset (Jose Ignacio Tornos Martinez) [RHEL-29093] {CVE-2023-52595} - wifi: iwlwifi: fix a memory corruption (Jose Ignacio Tornos Martinez) [RHEL-28903] {CVE-2024-26610} - [rt] build kernel-rt-4.18.0-553.4.1.rt7.345.el8_10 [RHEL-34640] - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117] - net/mlx5e: Prevent deadlock while disabling aRFS (Kamal Heib) [RHEL-35041] {CVE-2024-27014} - x86/tsc: Defer marking TSC unstable to a worker (Wander Lairson Costa) [RHEL-32676] - x86/smpboot: Make TSC synchronization function call based (Wander Lairson Costa) [RHEL-32676] - net: usb: fix possible use-after-free in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - net: usb: fix memory leak in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - [rt] build kernel-rt-4.18.0-552.3.1.rt7.344.el8_10 [RHEL-34640] - netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (Phil Sutter) [RHEL-30076] {CVE-2024-26643} - netfilter: nf_tables: disallow anonymous set with timeout flag (Phil Sutter) [RHEL-30080] {CVE-2024-26642} - selftests/bpf: Fix pyperf180 compilation failure with clang18 (Artem Savkov) [RHEL-35576] - md/raid5: fix atomicity violation in raid5_cache_count (Nigel Croxon) [RHEL-27930] {CVE-2024-23307} - usb: ulpi: Fix debugfs directory leak (Desnes Nunes) [RHEL-33287] {CVE-2024-26919} - powerpc/pseries: Fix potential memleak in papr_get_attr() (Mamatha Inamdar) [RHEL-35213] {CVE-2022-48669} - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (Desnes Nunes) [RHEL-35122] {CVE-2024-27059} - NFSv4: fairly test all delegations on a SEQ4_ revocation (Benjamin Coddington) [RHEL-34912] - USB: core: Fix deadlock in usb_deauthorize_interface() (Desnes Nunes) [RHEL-35002] {CVE-2024-26934} - usb: xhci: Add error handling in xhci_map_urb_for_dma (Desnes Nunes) [RHEL-34958] {CVE-2024-26964} - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (Ewan D. Milne) [RHEL-35076] {CVE-2024-26993} - xhci: handle isoc Babble and Buffer Overrun events properly (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - xhci: process isoc TD properly when there was a transaction error mid TD. (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - USB: core: Fix deadlock in port "disable" sysfs attribute (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - USB: core: Add hub_get() and hub_put() routines (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - netfilter: ipset: Missing gc cancellations fixed (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix performance regression in swap operation (Phil Sutter) [RHEL-30521] - netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test (Phil Sutter) [RHEL-30521] - x86/apic/x2apic: Fix a NULL pointer deref when handling a dying cpu (David Arcari) [RHEL-32516] - x86/coco: Disable 32-bit emulation by default on TDX and SEV (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Make IA32_EMULATION boot time configurable (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/elf: Make loading of 32bit processes depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Rename ignore_sysret() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/cpu: Don't write CSTAR MSR on Intel CPUs (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Introduce ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - [rt] build kernel-rt-4.18.0-552.2.1.rt7.343.el8_10 [RHEL-34640] - s390/ptrace: handle setting of fpc register correctly (Tobias Huschle) [RHEL-29106] {CVE-2023-52598} - net/smc: fix illegal rmb_desc access in SMC-D connection dump (Tobias Huschle) [RHEL-27746] {CVE-2024-26615} - wifi: mac80211: fix race condition on enabling fast-xmit (Jose Ignacio Tornos Martinez) [RHEL-31664] {CVE-2024-26779} - powerpc/fadump: make is_kdump_kernel() return false when fadump is active (Mamatha Inamdar) [RHEL-24401] - vmcore: remove dependency with is_kdump_kernel() for exporting vmcore (Mamatha Inamdar) [RHEL-24401] - mtd: require write permissions for locking and badblock ioctls (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - mtd: properly check all write ioctls for permissions (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - pid: take a reference when initializing `cad_pid` (Waiman Long) [RHEL-29420] {CVE-2021-47118} - i2c: i801: Don't generate an interrupt on bus reset (Prarit Bhargava) [RHEL-30325] {CVE-2021-47153} - RDMA/srpt: Do not register event handler until srpt device is fully setup (Kamal Heib) [RHEL-33224] {CVE-2024-26872} - ceph: switch to corrected encoding of max_xattr_size in mdsmap (Xiubo Li) [RHEL-26723] - ceph: switch to use cap_delay_lock for the unlink delay list (Xiubo Li) [RHEL-32870] - ceph: pass ino# instead of old_dentry if it's disconnected (Xiubo Li) [RHEL-32870] - fat: fix uninitialized field in nostale filehandles (Andrey Albershteyn) [RHEL-33186 RHEL-35108] {CVE-2024-26973} - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (Andrey Albershteyn) [RHEL-33186] {CVE-2024-26901} - idpf: limit the support to GCP only (Michal Schmidt) [RHEL-15652] - redhat/configs: enable CONFIG_IDPF (Michal Schmidt) [RHEL-15652] - idpf: remove the use of ETHTOOL_RING_USE_TCP_DATA_SPLIT (Michal Schmidt) [RHEL-15652] - idpf: workaround for unavailable skb page recycling (Michal Schmidt) [RHEL-15652] - idpf: always allocate a full page (Michal Schmidt) [RHEL-15652] - idpf: remove page pool stats code (Michal Schmidt) [RHEL-15652] - idpf: add minimal macros for __free(kfree) to work (Michal Schmidt) [RHEL-15652] - idpf: fixup include paths for RHEL 8 (Michal Schmidt) [RHEL-15652] - idpf: fix kernel panic on unknown packet types (Michal Schmidt) [RHEL-15652] - idpf: disable local BH when scheduling napi for marker packets (Michal Schmidt) [RHEL-15652] - idpf: remove dealloc vector msg err in idpf_intr_rel (Michal Schmidt) [RHEL-15652] - idpf: fix minor controlq issues (Michal Schmidt) [RHEL-15652] - idpf: prevent deinit uninitialized virtchnl core (Michal Schmidt) [RHEL-15652] - idpf: cleanup virtchnl cruft (Michal Schmidt) [RHEL-15652] - idpf: refactor idpf_recv_mb_msg (Michal Schmidt) [RHEL-15652] - idpf: add async_handler for MAC filter messages (Michal Schmidt) [RHEL-15652] - idpf: refactor remaining virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor queue related virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor vport virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: implement virtchnl transaction manager (Michal Schmidt) [RHEL-15652] - idpf: add idpf_virtchnl.h (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler padding in virtchnl2_ptype struct (Michal Schmidt) [RHEL-15652] - idpf: distinguish vports by the dev_port attribute (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler introduced padding in virtchnl2_rss_key struct (Michal Schmidt) [RHEL-15652] - idpf: fix corrupted frames and skb leaks in singleq mode (Michal Schmidt) [RHEL-15652] - idpf: refactor some missing field get/prep conversions (Michal Schmidt) [RHEL-15652] - idpf: add get/set for Ethtool's header split ringparam (Michal Schmidt) [RHEL-15652] - idpf: fix potential use-after-free in idpf_tso() (Michal Schmidt) [RHEL-15652] - idpf: cancel mailbox work in error path (Michal Schmidt) [RHEL-15652] - idpf: set scheduling mode for completion queue (Michal Schmidt) [RHEL-15652] - idpf: add SRIOV support and other ndo_ops (Michal Schmidt) [RHEL-15652] - idpf: add ethtool callbacks (Michal Schmidt) [RHEL-15652] - idpf: add singleq start_xmit and napi poll (Michal Schmidt) [RHEL-15652] - idpf: add RX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add TX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add splitq start_xmit (Michal Schmidt) [RHEL-15652] - idpf: initialize interrupts and enable vport (Michal Schmidt) [RHEL-15652] - idpf: configure resources for RX queues (Michal Schmidt) [RHEL-15652] - idpf: configure resources for TX queues (Michal Schmidt) [RHEL-15652] - idpf: add ptypes and MAC filter support (Michal Schmidt) [RHEL-15652] - idpf: add create vport and netdev configuration (Michal Schmidt) [RHEL-15652] - idpf: add core init and interrupt request (Michal Schmidt) [RHEL-15652] - idpf: add controlq init and reset checks (Michal Schmidt) [RHEL-15652] - idpf: add module register and probe functionality (Michal Schmidt) [RHEL-15652] - virtchnl: add virtchnl version 2 ops (Michal Schmidt) [RHEL-15652] - net: netdev_queue: netdev_txq_completed_mb(): fix wake condition (Michal Schmidt) [RHEL-15652] - net: piggy back on the memory barrier in bql when waking queues (Michal Schmidt) [RHEL-15652] - net: provide macros for commonly copied lockless queue stop/wake code (Michal Schmidt) [RHEL-15652] - [rt] build kernel-rt-4.18.0-552.1.1.rt7.342.el8_10 [RHEL-34640] - build: Update RTBZ for 8.10 z-stream builds (Denys Vlasenko) - redhat: set DIST to el8_10 and ZSTREAM to yes for 8.10 (Denys Vlasenko) - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (Prarit Bhargava) [RHEL-32590] {CVE-2021-47185} - net: mana: Fix Rx DMA datasize and skb_over_panic (Cathy Avery) [RHEL-32579] - RDMA/srpt: Support specifying the srpt_service_guid parameter (Kamal Heib) [RHEL-31710] {CVE-2024-26744} - RDMA/qedr: Fix qedr_create_user_qp error flow (Kamal Heib) [RHEL-31714] {CVE-2024-26743} - hwmon: (coretemp) Fix out-of-bounds memory access (David Arcari) [RHEL-31305] {CVE-2024-26664} - RDMA/irdma: Fix KASAN issue with tasklet (Kamal Heib) [RHEL-15776] - net: bridge: use DEV_STATS_INC() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: Fix unwanted sign extension in netdev_stats_to_stats64() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: add atomic_long_t to net_device_stats fields (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net/sched: act_ct: fix skb leak and crash on ooo frags (Xin Long) [RHEL-29467] {CVE-2023-52610} - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Jose Ignacio Tornos Martinez) [RHEL-28015] {CVE-2023-52528} - RDMA/core: Fix uninit-value access in ib_get_eth_speed() (Kamal Heib) [RHEL-30130] - RDMA/core: Get IB width and speed from netdev (Kamal Heib) [RHEL-30130] - cpufreq: intel_pstate: Add Emerald Rapids support in no-HWP mode (Prarit Bhargava) [RHEL-29444] - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add (Mamatha Inamdar) [RHEL-29118] {CVE-2023-52607} - powerpc/lib: Validate size for vector operations (Mamatha Inamdar) [RHEL-29114] {CVE-2023-52606} - usb: hub: Guard against accesses to uninitialized BOS descriptors (Desnes Nunes) [RHEL-28986] {CVE-2023-52477} - media: uvcvideo: Fix OOB read (Desnes Nunes) [RHEL-27940] {CVE-2023-52565} - media: pvrusb2: fix use after free on context disconnection (Desnes Nunes) [RHEL-26498] {CVE-2023-52445} - i2c: i801: Fix block process call transactions (Prarit Bhargava) [RHEL-26478] {CVE-2024-26593} - overlay: disable EVM (Coiby Xu) [RHEL-19863] - evm: add support to disable EVM on unsupported filesystems (Coiby Xu) [RHEL-19863] - evm: don't copy up 'security.evm' xattr (Coiby Xu) [RHEL-19863] - net: ena: Remove ena_select_queue (Kamal Heib) [RHEL-14286] - media: dvbdev: Fix memory leak in dvb_media_device_free() (Prarit Bhargava) [RHEL-27254] {CVE-2020-36777} - gfs2: Fix invalid metadata access in punch_hole (Andrew Price) [RHEL-28784] - i2c: Fix a potential use after free (Prarit Bhargava) [RHEL-26849] {CVE-2019-25162} - i2c: validate user data in compat ioctl (Prarit Bhargava) [RHEL-27022] {CVE-2021-46934} - platform/x86: think-lmi: Fix reference leak (Prarit Bhargava) [RHEL-28030] {CVE-2023-52520} - vhost: use kzalloc() instead of kmalloc() followed by memset() (Jon Maloy) [RHEL-21505] {CVE-2024-0340} - RDMA/siw: Fix connection failure handling (Kamal Heib) [RHEL-28042] {CVE-2023-52513} - vt: fix memory overlapping when deleting chars in the buffer (Waiman Long) [RHEL-27778 RHEL-27779] {CVE-2022-48627} - x86/fpu: Stop relying on userspace for info to fault in xsave buffer (Steve Best) [RHEL-26669] {CVE-2024-26603} - mptcp: fix double-free on socket dismantle (Davide Caratti) [RHEL-22773] {CVE-2024-26782} - crypto: akcipher - Disable signing and decryption (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: akcipher - default implementations for request callbacks (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: testmgr - split akcipher tests by a key type (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - workqueue: Warn when a rescuer could not be created (Waiman Long) [RHEL-22136] - RDMA/cma: Avoid GID lookups on iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/cma: Deduplicate error flow in cma_validate_port() (Benjamin Coddington) [RHEL-12456] - RDMA/core: Set gid_attr.ndev for iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/siw: Fabricate a GID on tun and loopback devices (Benjamin Coddington) [RHEL-12456] - eventpoll: fix missing wakeup for ovflist in ep_poll_callback (Luis Claudio R. Goncalves) [RHEL-23022] - [rt] build kernel-rt-4.18.0-552.rt7.341.el8 [RHEL-5332] - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248] - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248] - [rt] build kernel-rt-4.18.0-551.rt7.340.el8 [RHEL-5332] - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742} - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992] - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992] - [rt] build kernel-rt-4.18.0-550.rt7.339.el8 [RHEL-5332] - mm/sparsemem: fix race in accessing memory_section->usage (Waiman Long) [RHEL-28875 RHEL-28876] {CVE-2023-52489} - mm: use __pfn_to_section() instead of open coding it (Waiman Long) [RHEL-28875] {CVE-2023-52489} - [rt] build kernel-rt-4.18.0-549.rt7.338.el8 [RHEL-5332] - dm-integrity: align the outgoing bio in integrity_recheck (Benjamin Marzinski) [RHEL-29678] - dm-integrity: fix a memory leak when rechecking the data (Benjamin Marzinski) [RHEL-29678] - RDMA/mana_ib: Add CQ interrupt support for RAW QP (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: query device capabilities (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: register RDMA device with GDMA (Maxim Levitsky) [RHEL-23934] - net: mana: add msix index sharing between EQs (Maxim Levitsky) [RHEL-23934] - net: mana: Fix spelling mistake "enforecement" -> "enforcement" (Maxim Levitsky) [RHEL-23934] - net :mana :Add remaining GDMA stats for MANA to ethtool (Maxim Levitsky) [RHEL-23934] - net: mana: Fix oversized sge0 for GSO packets (Maxim Levitsky) [RHEL-23934] - net: mana: Fix TX CQE error handling (Maxim Levitsky) [RHEL-23934] - net: mana: Add gdma stats to ethtool output for mana (Maxim Levitsky) [RHEL-23934] - net: mana: Fix MANA VF unload when hardware is unresponsive (Maxim Levitsky) [RHEL-23934] - net: mana: Configure hwc timeout from hardware (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (Maxim Levitsky) [RHEL-23934] - [rt] build kernel-rt-4.18.0-548.rt7.337.el8 [RHEL-5332] - gitlab-ci: enable arm64/s390x/ppc64le debug builds (Michael Hofmann) - arm64: Add missing bits of AmpereOne Spectre-BHB mitigation (Mark Salter) [RHEL-29005] - [rt] enable CONFIG_DRM_MGAG200_IOBURST_WORKAROUND (Jocelyn Falempe) [RHEL-13214] - drm/mgag200: Add a workaround for low-latency (Jocelyn Falempe) [RHEL-13214] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - [rt] build kernel-rt-4.18.0-553.8.1.rt7.349.el8_10 [RHEL-40882] - udf: Fix NULL pointer dereference in udf_symlink function (Pavel Reichl) [RHEL-37769] {CVE-2021-47353} - net: ti: fix UAF in tlan_remove_one (Jose Ignacio Tornos Martinez) [RHEL-38940] {CVE-2021-47310} - ARM: footbridge: fix PCI interrupt mapping (Myron Stowe) [RHEL-26971] {CVE-2021-46909} - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (Kamal Heib) [RHEL-37454] {CVE-2024-36004} - net/mlx5e: Fix mlx5e_priv_init() cleanup flow (Kamal Heib) [RHEL-37424] {CVE-2024-35959} - net/mlx5: Properly link new fs rules into the tree (Kamal Heib) [RHEL-37420] {CVE-2024-35960} - net/mlx5e: fix a potential double-free in fs_any_create_groups (Kamal Heib) [RHEL-37091] {CVE-2023-52667} - net: ena: Fix incorrect descriptor free behavior (Kamal Heib) [RHEL-37428] {CVE-2024-35958} - mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - mISDN: fix possible use-after-free in HFC_cleanup() (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - implement dh fallback for primes > 4K (Vladis Dronov) [RHEL-35106] - crypto: qat - avoid division by zero (Vladis Dronov) [RHEL-35106] - crypto: qat - resolve race condition during AER recovery (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - use kcalloc_node() instead of kzalloc_node() (Vladis Dronov) [RHEL-35106] - [rt] Enable CONFIG_DRM_MGAG200_DISABLE_WRITECOMBINE (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Add an option to disable Write-Combine (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Fix caching setup for remapped video memory (Jocelyn Falempe) [RHEL-36172] - Revert "drm/mgag200: Add a workaround for low-latency" (Jocelyn Falempe) [RHEL-36172] - mptcp: fix data re-injection from stale subflow (Davide Caratti) [RHEL-33133] {CVE-2024-26826} - ipv6: sr: fix incorrect unregister order (Hangbin Liu) [RHEL-31730] - ipv6: sr: fix possible use-after-free and null-ptr-deref (Hangbin Liu) [RHEL-31730] {CVE-2024-26735} - net/bnx2x: Prevent access to a freed page in page_pool (Michal Schmidt) [RHEL-14195 RHEL-33243] {CVE-2024-26859} - bnx2x: new flag for track HW resource allocation (Michal Schmidt) [RHEL-14195 RHEL-33243] - bnx2x: fix page fault following EEH recovery (Michal Schmidt) [RHEL-14195 RHEL-33243] - x86: KVM: SVM: always update the x2avic msr interception (Maxim Levitsky) [RHEL-15495] {CVE-2023-5090} - EDAC/thunderx: Fix possible out-of-bounds string access (Aristeu Rozanski) [RHEL-26573] {CVE-2023-52464} - [rt] build kernel-rt-4.18.0-553.7.1.rt7.348.el8_10 [RHEL-34640] - net: qcom/emac: fix UAF in emac_remove (Ken Cox) [RHEL-37834] {CVE-2021-47311} - perf/core: Bail out early if the request AUX area is out of bound (Michael Petlan) [RHEL-38268] {CVE-2023-52835} - crypto: pcrypt - Fix hungtask for PADATA_RESET (Herbert Xu) [RHEL-38171] {CVE-2023-52813} - drm/amdgpu: fix use-after-free bug (Jocelyn Falempe) [RHEL-31240] {CVE-2024-26656} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash (Ivan Vecera) [RHEL-37008] {CVE-2024-35854} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update (Ivan Vecera) [RHEL-37004] {CVE-2024-35855} - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (Ivan Vecera) [RHEL-37012] {CVE-2024-35853} - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work (Ivan Vecera) [RHEL-37016] {CVE-2024-35852} - mlxsw: spectrum_acl_tcam: Fix warning during rehash (Ivan Vecera) [RHEL-37480] {CVE-2024-36007} - can: peak_pci: peak_pci_remove(): fix UAF (Jose Ignacio Tornos Martinez) [RHEL-38419] {CVE-2021-47456} - usbnet: fix error return code in usbnet_probe() (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - usbnet: sanity check for maxpacket (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - net/mlx5e: fix a double-free in arfs_create_groups (Kamal Heib) [RHEL-36920] {CVE-2024-35835} - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds (Jose Ignacio Tornos Martinez) [RHEL-38220] {CVE-2023-52878} - net: cdc_eem: fix tx fixup skb leak (Jose Ignacio Tornos Martinez) [RHEL-38080] {CVE-2021-47236} - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Jose Ignacio Tornos Martinez) [RHEL-38113] {CVE-2023-52703} - usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() (Desnes Nunes) [RHEL-38248] {CVE-2023-52877} - usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (Desnes Nunes) [RHEL-38240] {CVE-2023-52781} - gro: fix ownership transfer (Xin Long) [RHEL-37226] {CVE-2024-35890} - tipc: fix kernel warning when sending SYN message (Xin Long) [RHEL-38109] {CVE-2023-52700} - erspan: make sure erspan_base_hdr is present in skb->head (Xin Long) [RHEL-37230] {CVE-2024-35888} - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() (Bryan Gurney) [RHEL-17366] - scsi: mpi3mr: Sanitise num_phys (Bryan Gurney) [RHEL-17366] - netfilter: nf_tables: use timestamp to check for set element timeout (Phil Sutter) [RHEL-38023] {CVE-2024-27397} - net/ipv6: SKB symmetric hash should incorporate transport ports (Sabrina Dubroca) [RHEL-32061] - crypto: s390/aes - Fix buffer overread in CTR mode (Herbert Xu) [RHEL-37089] {CVE-2023-52669} - net: Save and restore msg_namelen in sock_sendmsg (Jamie Bainbridge) [RHEL-35893] - net: prevent address rewrite in kernel_bind() (Jamie Bainbridge) [RHEL-35893] - net: prevent rewrite of msg_name in sock_sendmsg() (Jamie Bainbridge) [RHEL-35893] - net: replace calls to sock->ops->connect() with kernel_connect() (Jamie Bainbridge) [RHEL-35893] - net: Avoid address overwrite in kernel_connect (Jamie Bainbridge) [RHEL-35893] - wifi: iwlwifi: dbg-tlv: ensure NUL termination (Jose Ignacio Tornos Martinez) [RHEL-37026] {CVE-2024-35845} - wifi: mac80211: fix potential sta-link leak (Jose Ignacio Tornos Martinez) [RHEL-36916] {CVE-2024-35838} - wifi: nl80211: reject iftype change with mesh ID change (Jose Ignacio Tornos Martinez) [RHEL-36884] {CVE-2024-27410} - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (Jose Ignacio Tornos Martinez) [RHEL-36807] {CVE-2024-35789} - Bluetooth: Avoid potential use-after-free in hci_error_reset (David Marlin) [RHEL-31826] {CVE-2024-26801} - tls: disable async encrypt/decrypt (Sabrina Dubroca) [RHEL-26362 RHEL-26409 RHEL-26420] {CVE-2024-26585 CVE-2024-26583 CVE-2024-26584} - Squashfs: check the inode number is not the invalid value of zero (Phillip Lougher) [RHEL-35096] {CVE-2024-26982} - ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/msg.c: update and document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/sem.c: document and update memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: update/document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: remove duplicated code (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (Kamal Heib) [RHEL-30582] {CVE-2023-52626} - Revert "ACPI: bus: Rework system-level device notification handling" (Prarit Bhargava) [RHEL-21486] - hwrng: core - Fix page fault dead lock on mmap-ed hwrng (Prarit Bhargava) [RHEL-29485] {CVE-2023-52615} - [rt] build kernel-rt-4.18.0-553.6.1.rt7.347.el8_10 [RHEL-34640] - cxgb4: Properly lock TX queue for the selftest. (John B. Wyatt IV) [RHEL-8779] - powerpc/powernv: Add a null pointer check in opal_event_init() (Mamatha Inamdar) [RHEL-37058] {CVE-2023-52686} - crypto: rsa - add a check for allocation failure (Vladis Dronov) [RHEL-35361] - crypto: rsa - allow only odd e and restrict value in FIPS mode (Vladis Dronov) [RHEL-35361] - KEYS: use kfree_sensitive with key (Vladis Dronov) [RHEL-35361] - lib/mpi: Extend the MPI library (only mpi_*_bit() part) (Vladis Dronov) [RHEL-35361] - net: ip_tunnel: prevent perpetual headroom growth (Felix Maurer) [RHEL-31814] {CVE-2024-26804} - s390/cpum_cf: make crypto counters upward compatible across machine types (Tobias Huschle) [RHEL-36048] - RDMA/mlx5: Fix fortify source warning while accessing Eth segment (Kamal Heib) [RHEL-33162] {CVE-2024-26907} - ovl: fix leaked dentry (Miklos Szeredi) [RHEL-27306] {CVE-2021-46972} - x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - x86/mm/vsyscall: Consider vsyscall page part of user address space (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - x86/mm: Add vsyscall address helper (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - mm/swap: fix race when skipping swapcache (Rafael Aquini) [RHEL-31644] {CVE-2024-26759} - swap: fix do_swap_page() race with swapoff (Rafael Aquini) [RHEL-31644] {CVE-2024-26759} - mm/swapfile: use percpu_ref to serialize against concurrent swapoff (Rafael Aquini) [RHEL-31644] {CVE-2024-26759} - mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions() (Rafael Aquini) [RHEL-29294] {CVE-2023-52560} - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr (Jiri Benc) [RHEL-29783] - block: null_blk: Fix handling of fake timeout request (Ming Lei) [RHEL-8130] - null_blk: fix poll request timeout handling (Ming Lei) [RHEL-8130] - block: null_blk: end timed out poll request (Ming Lei) [RHEL-8130] - block: null_blk: only set set->nr_maps as 3 if active poll_queues is > 0 (Ming Lei) [RHEL-8130] - null_blk: allow zero poll queues (Ming Lei) [RHEL-8130] - null_blk: Fix handling of submit_queues and poll_queues attributes (Ming Lei) [RHEL-8130] - null_blk: poll queue support (Ming Lei) [RHEL-8130] - null_blk: fix command timeout completion handling (Ming Lei) [RHEL-8130] - platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (Prarit Bhargava) [RHEL-27790] {CVE-2021-47073} - Bluetooth: avoid memcmp() out of bounds warning (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: hci_event: Fix coding style (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: hci_event: Fix using memcmp when comparing keys (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: Reject connection with the device which has same BD_ADDR (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: hci_event: Ignore NULL link key (David Marlin) [RHEL-3017] {CVE-2020-26555} - ppp_async: limit MRU to 64K (Guillaume Nault) [RHEL-31353] {CVE-2024-26675} - powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (Mamatha Inamdar) [RHEL-37078] {CVE-2023-52675} - tcp: do not accept ACK of bytes we never sent (Xin Long) [RHEL-21952] - [rt] build kernel-rt-4.18.0-553.5.1.rt7.346.el8_10 [RHEL-34640] - tools/power/turbostat: Fix uncore frequency file string (David Arcari) [RHEL-29238] - tools/power turbostat: Expand probe_intel_uncore_frequency() (David Arcari) [RHEL-29238] - uio: Fix use-after-free in uio_open (Ricardo Robaina) [RHEL-26232] {CVE-2023-52439} - net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (Ken Cox) [RHEL-27316] {CVE-2021-47013} - keys: Fix linking a duplicate key to a keyring's assoc_array (David Howells) [RHEL-30772] - keys: Hoist locking out of __key_link_begin() (David Howells) [RHEL-30772] - keys: Break bits out of key_unlink() (David Howells) [RHEL-30772] - keys: Change keyring_serialise_link_sem to a mutex (David Howells) [RHEL-30772] - wifi: brcm80211: handle pmk_op allocation failure (Jose Ignacio Tornos Martinez) [RHEL-35150] {CVE-2024-27048} - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work (Jose Ignacio Tornos Martinez) [RHEL-35140] {CVE-2024-27052} - wifi: iwlwifi: mvm: ensure offloading TID queue exists (Jose Ignacio Tornos Martinez) [RHEL-35130] {CVE-2024-27056} - wifi: mt76: mt7921e: fix use-after-free in free_irq() (Jose Ignacio Tornos Martinez) [RHEL-34866] {CVE-2024-26892} - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete (Jose Ignacio Tornos Martinez) [RHEL-34189] {CVE-2024-26897} - wifi: iwlwifi: mvm: fix a crash when we run out of stations (Jose Ignacio Tornos Martinez) [RHEL-31547] {CVE-2024-26693} - wifi: iwlwifi: fix double-free bug (Jose Ignacio Tornos Martinez) [RHEL-31543] {CVE-2024-26694} - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (Jose Ignacio Tornos Martinez) [RHEL-29089] {CVE-2023-52594} - wifi: rt2x00: restart beacon queue when hardware reset (Jose Ignacio Tornos Martinez) [RHEL-29093] {CVE-2023-52595} - wifi: iwlwifi: fix a memory corruption (Jose Ignacio Tornos Martinez) [RHEL-28903] {CVE-2024-26610} - [rt] build kernel-rt-4.18.0-553.4.1.rt7.345.el8_10 [RHEL-34640] - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117] - net/mlx5e: Prevent deadlock while disabling aRFS (Kamal Heib) [RHEL-35041] {CVE-2024-27014} - x86/tsc: Defer marking TSC unstable to a worker (Wander Lairson Costa) [RHEL-32676] - x86/smpboot: Make TSC synchronization function call based (Wander Lairson Costa) [RHEL-32676] - net: usb: fix possible use-after-free in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - net: usb: fix memory leak in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - [rt] build kernel-rt-4.18.0-552.3.1.rt7.344.el8_10 [RHEL-34640] - netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (Phil Sutter) [RHEL-30076] {CVE-2024-26643} - netfilter: nf_tables: disallow anonymous set with timeout flag (Phil Sutter) [RHEL-30080] {CVE-2024-26642} - selftests/bpf: Fix pyperf180 compilation failure with clang18 (Artem Savkov) [RHEL-35576] - md/raid5: fix atomicity violation in raid5_cache_count (Nigel Croxon) [RHEL-27930] {CVE-2024-23307} - usb: ulpi: Fix debugfs directory leak (Desnes Nunes) [RHEL-33287] {CVE-2024-26919} - powerpc/pseries: Fix potential memleak in papr_get_attr() (Mamatha Inamdar) [RHEL-35213] {CVE-2022-48669} - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (Desnes Nunes) [RHEL-35122] {CVE-2024-27059} - NFSv4: fairly test all delegations on a SEQ4_ revocation (Benjamin Coddington) [RHEL-34912] - USB: core: Fix deadlock in usb_deauthorize_interface() (Desnes Nunes) [RHEL-35002] {CVE-2024-26934} - usb: xhci: Add error handling in xhci_map_urb_for_dma (Desnes Nunes) [RHEL-34958] {CVE-2024-26964} - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (Ewan D. Milne) [RHEL-35076] {CVE-2024-26993} - xhci: handle isoc Babble and Buffer Overrun events properly (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - xhci: process isoc TD properly when there was a transaction error mid TD. (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - USB: core: Fix deadlock in port "disable" sysfs attribute (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - USB: core: Add hub_get() and hub_put() routines (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - netfilter: ipset: Missing gc cancellations fixed (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix performance regression in swap operation (Phil Sutter) [RHEL-30521] - netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test (Phil Sutter) [RHEL-30521] - x86/apic/x2apic: Fix a NULL pointer deref when handling a dying cpu (David Arcari) [RHEL-32516] - x86/coco: Disable 32-bit emulation by default on TDX and SEV (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Make IA32_EMULATION boot time configurable (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/elf: Make loading of 32bit processes depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Rename ignore_sysret() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/cpu: Don't write CSTAR MSR on Intel CPUs (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Introduce ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - [rt] build kernel-rt-4.18.0-552.2.1.rt7.343.el8_10 [RHEL-34640] - s390/ptrace: handle setting of fpc register correctly (Tobias Huschle) [RHEL-29106] {CVE-2023-52598} - net/smc: fix illegal rmb_desc access in SMC-D connection dump (Tobias Huschle) [RHEL-27746] {CVE-2024-26615} - wifi: mac80211: fix race condition on enabling fast-xmit (Jose Ignacio Tornos Martinez) [RHEL-31664] {CVE-2024-26779} - powerpc/fadump: make is_kdump_kernel() return false when fadump is active (Mamatha Inamdar) [RHEL-24401] - vmcore: remove dependency with is_kdump_kernel() for exporting vmcore (Mamatha Inamdar) [RHEL-24401] - mtd: require write permissions for locking and badblock ioctls (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - mtd: properly check all write ioctls for permissions (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - pid: take a reference when initializing `cad_pid` (Waiman Long) [RHEL-29420] {CVE-2021-47118} - i2c: i801: Don't generate an interrupt on bus reset (Prarit Bhargava) [RHEL-30325] {CVE-2021-47153} - RDMA/srpt: Do not register event handler until srpt device is fully setup (Kamal Heib) [RHEL-33224] {CVE-2024-26872} - ceph: switch to corrected encoding of max_xattr_size in mdsmap (Xiubo Li) [RHEL-26723] - ceph: switch to use cap_delay_lock for the unlink delay list (Xiubo Li) [RHEL-32870] - ceph: pass ino# instead of old_dentry if it's disconnected (Xiubo Li) [RHEL-32870] - fat: fix uninitialized field in nostale filehandles (Andrey Albershteyn) [RHEL-33186 RHEL-35108] {CVE-2024-26973} - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (Andrey Albershteyn) [RHEL-33186] {CVE-2024-26901} - idpf: limit the support to GCP only (Michal Schmidt) [RHEL-15652] - redhat/configs: enable CONFIG_IDPF (Michal Schmidt) [RHEL-15652] - idpf: remove the use of ETHTOOL_RING_USE_TCP_DATA_SPLIT (Michal Schmidt) [RHEL-15652] - idpf: workaround for unavailable skb page recycling (Michal Schmidt) [RHEL-15652] - idpf: always allocate a full page (Michal Schmidt) [RHEL-15652] - idpf: remove page pool stats code (Michal Schmidt) [RHEL-15652] - idpf: add minimal macros for __free(kfree) to work (Michal Schmidt) [RHEL-15652] - idpf: fixup include paths for RHEL 8 (Michal Schmidt) [RHEL-15652] - idpf: fix kernel panic on unknown packet types (Michal Schmidt) [RHEL-15652] - idpf: disable local BH when scheduling napi for marker packets (Michal Schmidt) [RHEL-15652] - idpf: remove dealloc vector msg err in idpf_intr_rel (Michal Schmidt) [RHEL-15652] - idpf: fix minor controlq issues (Michal Schmidt) [RHEL-15652] - idpf: prevent deinit uninitialized virtchnl core (Michal Schmidt) [RHEL-15652] - idpf: cleanup virtchnl cruft (Michal Schmidt) [RHEL-15652] - idpf: refactor idpf_recv_mb_msg (Michal Schmidt) [RHEL-15652] - idpf: add async_handler for MAC filter messages (Michal Schmidt) [RHEL-15652] - idpf: refactor remaining virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor queue related virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor vport virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: implement virtchnl transaction manager (Michal Schmidt) [RHEL-15652] - idpf: add idpf_virtchnl.h (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler padding in virtchnl2_ptype struct (Michal Schmidt) [RHEL-15652] - idpf: distinguish vports by the dev_port attribute (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler introduced padding in virtchnl2_rss_key struct (Michal Schmidt) [RHEL-15652] - idpf: fix corrupted frames and skb leaks in singleq mode (Michal Schmidt) [RHEL-15652] - idpf: refactor some missing field get/prep conversions (Michal Schmidt) [RHEL-15652] - idpf: add get/set for Ethtool's header split ringparam (Michal Schmidt) [RHEL-15652] - idpf: fix potential use-after-free in idpf_tso() (Michal Schmidt) [RHEL-15652] - idpf: cancel mailbox work in error path (Michal Schmidt) [RHEL-15652] - idpf: set scheduling mode for completion queue (Michal Schmidt) [RHEL-15652] - idpf: add SRIOV support and other ndo_ops (Michal Schmidt) [RHEL-15652] - idpf: add ethtool callbacks (Michal Schmidt) [RHEL-15652] - idpf: add singleq start_xmit and napi poll (Michal Schmidt) [RHEL-15652] - idpf: add RX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add TX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add splitq start_xmit (Michal Schmidt) [RHEL-15652] - idpf: initialize interrupts and enable vport (Michal Schmidt) [RHEL-15652] - idpf: configure resources for RX queues (Michal Schmidt) [RHEL-15652] - idpf: configure resources for TX queues (Michal Schmidt) [RHEL-15652] - idpf: add ptypes and MAC filter support (Michal Schmidt) [RHEL-15652] - idpf: add create vport and netdev configuration (Michal Schmidt) [RHEL-15652] - idpf: add core init and interrupt request (Michal Schmidt) [RHEL-15652] - idpf: add controlq init and reset checks (Michal Schmidt) [RHEL-15652] - idpf: add module register and probe functionality (Michal Schmidt) [RHEL-15652] - virtchnl: add virtchnl version 2 ops (Michal Schmidt) [RHEL-15652] - net: netdev_queue: netdev_txq_completed_mb(): fix wake condition (Michal Schmidt) [RHEL-15652] - net: piggy back on the memory barrier in bql when waking queues (Michal Schmidt) [RHEL-15652] - net: provide macros for commonly copied lockless queue stop/wake code (Michal Schmidt) [RHEL-15652] - [rt] build kernel-rt-4.18.0-552.1.1.rt7.342.el8_10 [RHEL-34640] - build: Update RTBZ for 8.10 z-stream builds (Denys Vlasenko) - redhat: set DIST to el8_10 and ZSTREAM to yes for 8.10 (Denys Vlasenko) - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (Prarit Bhargava) [RHEL-32590] {CVE-2021-47185} - net: mana: Fix Rx DMA datasize and skb_over_panic (Cathy Avery) [RHEL-32579] - RDMA/srpt: Support specifying the srpt_service_guid parameter (Kamal Heib) [RHEL-31710] {CVE-2024-26744} - RDMA/qedr: Fix qedr_create_user_qp error flow (Kamal Heib) [RHEL-31714] {CVE-2024-26743} - hwmon: (coretemp) Fix out-of-bounds memory access (David Arcari) [RHEL-31305] {CVE-2024-26664} - RDMA/irdma: Fix KASAN issue with tasklet (Kamal Heib) [RHEL-15776] - net: bridge: use DEV_STATS_INC() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: Fix unwanted sign extension in netdev_stats_to_stats64() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: add atomic_long_t to net_device_stats fields (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net/sched: act_ct: fix skb leak and crash on ooo frags (Xin Long) [RHEL-29467] {CVE-2023-52610} - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Jose Ignacio Tornos Martinez) [RHEL-28015] {CVE-2023-52528} - RDMA/core: Fix uninit-value access in ib_get_eth_speed() (Kamal Heib) [RHEL-30130] - RDMA/core: Get IB width and speed from netdev (Kamal Heib) [RHEL-30130] - cpufreq: intel_pstate: Add Emerald Rapids support in no-HWP mode (Prarit Bhargava) [RHEL-29444] - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add (Mamatha Inamdar) [RHEL-29118] {CVE-2023-52607} - powerpc/lib: Validate size for vector operations (Mamatha Inamdar) [RHEL-29114] {CVE-2023-52606} - usb: hub: Guard against accesses to uninitialized BOS descriptors (Desnes Nunes) [RHEL-28986] {CVE-2023-52477} - media: uvcvideo: Fix OOB read (Desnes Nunes) [RHEL-27940] {CVE-2023-52565} - media: pvrusb2: fix use after free on context disconnection (Desnes Nunes) [RHEL-26498] {CVE-2023-52445} - i2c: i801: Fix block process call transactions (Prarit Bhargava) [RHEL-26478] {CVE-2024-26593} - overlay: disable EVM (Coiby Xu) [RHEL-19863] - evm: add support to disable EVM on unsupported filesystems (Coiby Xu) [RHEL-19863] - evm: don't copy up 'security.evm' xattr (Coiby Xu) [RHEL-19863] - net: ena: Remove ena_select_queue (Kamal Heib) [RHEL-14286] - media: dvbdev: Fix memory leak in dvb_media_device_free() (Prarit Bhargava) [RHEL-27254] {CVE-2020-36777} - gfs2: Fix invalid metadata access in punch_hole (Andrew Price) [RHEL-28784] - i2c: Fix a potential use after free (Prarit Bhargava) [RHEL-26849] {CVE-2019-25162} - i2c: validate user data in compat ioctl (Prarit Bhargava) [RHEL-27022] {CVE-2021-46934} - platform/x86: think-lmi: Fix reference leak (Prarit Bhargava) [RHEL-28030] {CVE-2023-52520} - vhost: use kzalloc() instead of kmalloc() followed by memset() (Jon Maloy) [RHEL-21505] {CVE-2024-0340} - RDMA/siw: Fix connection failure handling (Kamal Heib) [RHEL-28042] {CVE-2023-52513} - vt: fix memory overlapping when deleting chars in the buffer (Waiman Long) [RHEL-27778 RHEL-27779] {CVE-2022-48627} - x86/fpu: Stop relying on userspace for info to fault in xsave buffer (Steve Best) [RHEL-26669] {CVE-2024-26603} - mptcp: fix double-free on socket dismantle (Davide Caratti) [RHEL-22773] {CVE-2024-26782} - crypto: akcipher - Disable signing and decryption (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: akcipher - default implementations for request callbacks (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: testmgr - split akcipher tests by a key type (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - workqueue: Warn when a rescuer could not be created (Waiman Long) [RHEL-22136] - RDMA/cma: Avoid GID lookups on iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/cma: Deduplicate error flow in cma_validate_port() (Benjamin Coddington) [RHEL-12456] - RDMA/core: Set gid_attr.ndev for iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/siw: Fabricate a GID on tun and loopback devices (Benjamin Coddington) [RHEL-12456] - eventpoll: fix missing wakeup for ovflist in ep_poll_callback (Luis Claudio R. Goncalves) [RHEL-23022] - [rt] build kernel-rt-4.18.0-552.rt7.341.el8 [RHEL-5332] - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248] - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248] - [rt] build kernel-rt-4.18.0-551.rt7.340.el8 [RHEL-5332] - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742} - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992] - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825} - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237] - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724} - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513} - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921] - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921] - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921] - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921] - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921] - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774] - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660] - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660] - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199] - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539} - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825} - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237] - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724} - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513} - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921] - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921] - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921] - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921] - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921] - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285} - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993} - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396] - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396] - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396] - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396] - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355] - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355] - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355] - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355] - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355] - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355] - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240} - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek) - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963] - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171] - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171] - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226] - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226] - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744] - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744] - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744] - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744] - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew) [RHEL-129945] - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774] - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660] - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660] - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199] - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539} - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825} - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237] - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724} - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513} - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921] - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921] - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921] - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921] - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921] - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301} - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933} - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051} - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449] - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096} - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285} - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993} - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396] - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396] - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396] - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396] - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355] - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355] - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355] - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355] - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355] - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355] - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240} - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek) - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963] - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171] - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171] - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226] - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226] - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744] - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744] - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744] - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744] - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew) [RHEL-129945] - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774] - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660] - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660] - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199] - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539} - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - Bluetooth: hci_event: call disconnect callback before deleting conn (CKI Backport Bot) [RHEL-137039] {CVE-2023-53673} - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CKI Backport Bot) [RHEL-134423] {CVE-2025-40277} - xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 (John J Coleman) [RHEL-111354] - xen: Fix x86 sched_clock() interface for xen (John J Coleman) [RHEL-111354] - x86/xen/time: Output xen sched_clock time from 0 (John J Coleman) [RHEL-111354] - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Olga Kornievskaia) [RHEL-132819] - vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139273] {CVE-2025-40248} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ignore ndlp rport mismatch in dev_loss_tmo callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Modify handling of ADISC based on ndlp state and RPI registration (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Delete NLP_TARGET_REMOVE flag due to obsolete usage (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo callback (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Check devloss callbk done flag for potential stale NDLP ptrs (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kref imbalance on fabric ndlps from dev_loss_tmo handler (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Update PRLO handling in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Add condition to delete ndlp object after sending BLS_RJT to an ABTS (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove NLP_RCV_PLOGI early return during RSCN processing for ndlps (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Allow lpfc_plogi_confirm_nport() logic to execute for Fabric nodes (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix list_entry null check warning in lpfc_cmpl_els_plogi() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix possible file string name overflow when updating firmware (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Validate ELS LS_ACC completion payload (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove extra ndlp kref decrement in FLOGI cmpl for loop topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Revise NPIV ELS unsol rcv cmpl logic to drop ndlp based on nlp_state (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix double free in lpfc_cmpl_els_logo_acc() caused by lpfc_nlp_not_used() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Move scsi_host_template outside dynamically allocated/freed phba (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fill in missing ndlp kref puts in error paths (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login (Ewan D. Milne) [RHEL-32324] - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301} - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933} - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051} - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449] - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096} - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285} - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993} - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396] - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396] - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396] - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396] - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355] - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355] - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355] - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355] - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355] - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355] - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240} - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek) - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963] - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171] - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171] - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226] - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226] - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744] - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744] - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744] - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744] - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew) [RHEL-129945] - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117] - [rt] build kernel-rt-4.18.0-552.rt7.341.el8 [RHEL-5332] - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248] - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248] - [rt] build kernel-rt-4.18.0-551.rt7.340.el8 [RHEL-5332] - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742} - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992] - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992] - [rt] build kernel-rt-4.18.0-550.rt7.339.el8 [RHEL-5332] - mm/sparsemem: fix race in accessing memory_section->usage (Waiman Long) [RHEL-28875 RHEL-28876] {CVE-2023-52489} - mm: use __pfn_to_section() instead of open coding it (Waiman Long) [RHEL-28875] {CVE-2023-52489} - [rt] build kernel-rt-4.18.0-549.rt7.338.el8 [RHEL-5332] - dm-integrity: align the outgoing bio in integrity_recheck (Benjamin Marzinski) [RHEL-29678] - dm-integrity: fix a memory leak when rechecking the data (Benjamin Marzinski) [RHEL-29678] - RDMA/mana_ib: Add CQ interrupt support for RAW QP (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: query device capabilities (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: register RDMA device with GDMA (Maxim Levitsky) [RHEL-23934] - net: mana: add msix index sharing between EQs (Maxim Levitsky) [RHEL-23934] - net: mana: Fix spelling mistake "enforecement" -> "enforcement" (Maxim Levitsky) [RHEL-23934] - net :mana :Add remaining GDMA stats for MANA to ethtool (Maxim Levitsky) [RHEL-23934] - net: mana: Fix oversized sge0 for GSO packets (Maxim Levitsky) [RHEL-23934] - net: mana: Fix TX CQE error handling (Maxim Levitsky) [RHEL-23934] - net: mana: Add gdma stats to ethtool output for mana (Maxim Levitsky) [RHEL-23934] - net: mana: Fix MANA VF unload when hardware is unresponsive (Maxim Levitsky) [RHEL-23934] - net: mana: Configure hwc timeout from hardware (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (Maxim Levitsky) [RHEL-23934] - [rt] build kernel-rt-4.18.0-548.rt7.337.el8 [RHEL-5332] - gitlab-ci: enable arm64/s390x/ppc64le debug builds (Michael Hofmann) - arm64: Add missing bits of AmpereOne Spectre-BHB mitigation (Mark Salter) [RHEL-29005] - [rt] enable CONFIG_DRM_MGAG200_IOBURST_WORKAROUND (Jocelyn Falempe) [RHEL-13214] - drm/mgag200: Add a workaround for low-latency (Jocelyn Falempe) [RHEL-13214] - [rt] build kernel-rt-4.18.0-547.rt7.336.el8 [RHEL-5332] - x86/efistub: Avoid placing the kernel below LOAD_PHYSICAL_ADDR (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Give up if memory attribute protocol returns an error (Lenny Szubowicz) [RHEL-2505] - x86/boot: Increase section and file alignment to 4k/512 (Lenny Szubowicz) [RHEL-2505] - x86/boot: Split off PE/COFF .data section (Lenny Szubowicz) [RHEL-2505] - x86/boot: Drop PE/COFF .reloc section (Lenny Szubowicz) [RHEL-2505] - x86/boot: Construct PE/COFF .text section from assembler (Lenny Szubowicz) [RHEL-2505] - x86/boot: Derive file size from _edata symbol (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed: Remove, discard, or assert for unwanted sections (Lenny Szubowicz) [RHEL-2505] - x86/boot: Check that there are no run-time relocations (Lenny Szubowicz) [RHEL-2505] - x86/boot: Discard .discard.unreachable for arch/x86/boot/compressed/vmlinux (Lenny Szubowicz) [RHEL-2505] - x86/boot: Define setup size in linker script (Lenny Szubowicz) [RHEL-2505] - x86/boot: Set EFI handover offset directly in header asm (Lenny Szubowicz) [RHEL-2505] - x86/boot: Drop references to startup_64 (Lenny Szubowicz) [RHEL-2505] - x86/boot: Drop redundant code setting the root device (Lenny Szubowicz) [RHEL-2505] - x86/build: Declutter the build output (Lenny Szubowicz) [RHEL-2505] - x86/boot: Omit compression buffer from PE/COFF image memory footprint (Lenny Szubowicz) [RHEL-2505] - x86/boot: Mark global variables as static (Lenny Szubowicz) [RHEL-2505] - efi/x86: Remove extra headroom for setup block (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove the 'bugger off' message (Lenny Szubowicz) [RHEL-2505] - x86/efi: Drop alignment flags from PE section headers (Lenny Szubowicz) [RHEL-2505] - efi: Put Linux specific magic number in the DOS header (Lenny Szubowicz) [RHEL-2505] - efi/x86: Fix the missing KASLR_FLAG bit in boot_params->hdr.loadflags (Lenny Szubowicz) [RHEL-2505] - efi/x86: Avoid physical KASLR on older Dell systems (Lenny Szubowicz) [RHEL-2505] - x86/boot: efistub: Assign global boot_params variable (Lenny Szubowicz) [RHEL-2505] - x86/boot: Rename conflicting 'boot_params' pointer to 'boot_params_ptr' (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Avoid legacy decompressor when doing EFI boot (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Perform SNP feature test while running in the firmware (Lenny Szubowicz) [RHEL-2505] - x86/sev: Do not try to parse for the CC blob on non-AMD hardware (Lenny Szubowicz) [RHEL-2505] - efi/libstub: Add limit argument to efi_random_alloc() (Lenny Szubowicz) [RHEL-2505] - arm64: efi: Limit allocations to 48-bit addressable physical region (Lenny Szubowicz) [RHEL-2505] - efi: libstub: use EFI_LOADER_CODE region when moving the kernel in memory (Lenny Szubowicz) [RHEL-2505] - arm64: efi: kaslr: Fix occasional random alloc (and boot) failure (Lenny Szubowicz) [RHEL-2505] - efi/libstub/random: Increase random alloc granularity (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Factor out kernel decompression and relocation (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Move global symbol references to C code (Lenny Szubowicz) [RHEL-2505] - decompress: Use 8 byte alignment (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Prefer EFI memory attributes protocol over DXE services (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Perform 4/5 level paging switch from the stub (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Merge trampoline cleanup with switching code (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Pass pgtable address to trampoline directly (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Only call the trampoline when changing paging levels (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Call trampoline directly from C code (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Avoid the need for a stack in the 32-bit trampoline (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Use standard calling convention for trampoline (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Call trampoline as a normal function (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Remove .bss/.pgtable from bzImage (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove run-time relocations from .head.text code (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Assign paging related global variables earlier (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Store boot_params pointer in callee save register (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Clear BSS in EFI handover protocol entrypoint (Lenny Szubowicz) [RHEL-2505] - x86/head_64: Store boot_params pointer in callee save register (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Don't rely on upper 32 bits of GPRs being preserved (Lenny Szubowicz) [RHEL-2505] - x86/head/64: Switch to KERNEL_CS as soon as new GDT is installed (Lenny Szubowicz) [RHEL-2505] - efi/libstub: Add memory attribute protocol definitions (Lenny Szubowicz) [RHEL-2505] - efi/x86: libstub: remove unused variable (Lenny Szubowicz) [RHEL-2505] - x86/boot: Robustify calling startup_{32,64}() from the decompressor code (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Simplify and clean up handover entry code (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Branch straight to kernel entry point from C code (Lenny Szubowicz) [RHEL-2505] - efi/x86: Avoid using code32_start (Lenny Szubowicz) [RHEL-2505] - efi/libstub/x86: Use Exit() boot service to exit the stub on errors (Lenny Szubowicz) [RHEL-2505] - efi: x86: Wipe setup_data on pure EFI boot (Lenny Szubowicz) [RHEL-2505] - efi: x86: Fix config name for setting the NX-compatibility flag in the PE header (Lenny Szubowicz) [RHEL-2505] - efi: x86: Set the NX-compatibility flag in the PE header (Lenny Szubowicz) [RHEL-2505] - efi/x86: Add kernel preferred address to PE header (Lenny Szubowicz) [RHEL-2505] - efi/x86: Use symbolic constants in PE header instead of bare numbers (Lenny Szubowicz) [RHEL-2505] - efi/x86: Drop redundant .bss section (Lenny Szubowicz) [RHEL-2505] - efi/x86: add headroom to decompressor BSS to account for setup block (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove run-time relocations from head_{32,64}.S (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed: Fix debug_puthex() parameter type (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Use 32-bit (zero-extended) MOV for z_output_len (Lenny Szubowicz) [RHEL-2505] - x86/boot: Use unsigned comparison for addresses (Lenny Szubowicz) [RHEL-2505] - x86/boot: Micro-optimize GDT loading instructions (Lenny Szubowicz) [RHEL-2505] - x86/boot: GDT limit value should be size - 1 (Lenny Szubowicz) [RHEL-2505] - efi/x86: Remove GDT setup from efi_main (Lenny Szubowicz) [RHEL-2505] - x86/boot: Clear direction and interrupt flags in startup_64 (Lenny Szubowicz) [RHEL-2505] - efi/x86: Don't depend on firmware GDT layout (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove KEEP_SEGMENTS support (Lenny Szubowicz) [RHEL-2505] - x86/boot: Handle malformed SRAT tables during early ACPI parsing (Lenny Szubowicz) [RHEL-2505] - efi/libstub/x86: Use mandatory 16-byte stack alignment in mixed mode (Lenny Szubowicz) [RHEL-2505] - efi/libstub/x86: Avoid globals to store context during mixed mode calls (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Disable paging at mixed mode entry (Lenny Szubowicz) [RHEL-2505] - x86: efi/random: Invoke EFI_RNG_PROTOCOL to seed the UEFI RNG table (Lenny Szubowicz) [RHEL-2505] - x86/asm: Make some functions local (Lenny Szubowicz) [RHEL-2505] - x86/boot: Annotate data appropriately (Lenny Szubowicz) [RHEL-2505] - x86/boot: Annotate local functions (Lenny Szubowicz) [RHEL-2505] - x86/asm: Make more symbols local (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Fix missing initialization in find_trampoline_placement() (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Fix boot on machines with broken E820 table (Lenny Szubowicz) [RHEL-2505] - x86, boot: Remove multiple copy of static function sanitize_boot_params() (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Remove unused variable (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Explain paging_prepare()'s return value (Lenny Szubowicz) [RHEL-2505] - x86/boot: Save several bytes in decompressor (Lenny Szubowicz) [RHEL-2505] - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (Audra Mitchell) [RHEL-20614] {CVE-2024-0841} - net/gve: update check for little-endianness in gve kconfig (Joshua Washington) [RHEL-29030] - [rt] build kernel-rt-4.18.0-546.rt7.335.el8 [RHEL-5332] - sched/membarrier: reduce the ability to hammer on sys_membarrier (Wander Lairson Costa) [RHEL-23430] {CVE-2024-26602} - NFS: Set the stable writes flag when initialising the super block (Benjamin Coddington) [RHEL-25266] - smb: client: fix OOB in receive_encrypted_standard() (Scott Mayhew) [RHEL-21685] {CVE-2024-0565} - scsi: core: Move scsi_host_busy() out of host lock if it is for per-command (Ming Lei) [RHEL-23942] - scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler (Ming Lei) [RHEL-23942] - gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump (Andrew Price) [RHEL-26501] {CVE-2023-52448} - smb: client: fix parsing of SMB3.1.1 POSIX create context (Paulo Alcantara) [RHEL-26241] {CVE-2023-52434} - smb: client: fix potential OOBs in smb2_parse_contexts() (Paulo Alcantara) [RHEL-26241] {CVE-2023-52434} - smb3: Replace smb2pdu 1-element arrays with flex-arrays (Jay Shin) [RHEL-22143] - cifs: Replace remaining 1-element arrays (Jay Shin) [RHEL-22143] - cifs: Convert struct fealist away from 1-element array (Jay Shin) [RHEL-22143] - cifs: remove unneeded 2bytes of padding from smb2 tree connect (Jay Shin) [RHEL-22143] - cifs: Replace zero-length arrays with flexible-array members (Jay Shin) [RHEL-22143] - cifs: Replace a couple of one-element arrays with flexible-array members (Jay Shin) [RHEL-22143] - cifs: fix FILE_BOTH_DIRECTORY_INFO definition (Jay Shin) [RHEL-22143] - nfsd: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - nfs: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - lockd: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - cifs: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - ceph: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - filelock: add a new locks_inode_context accessor function (Jeffrey Layton) [RHEL-27441] - dm-integrity, dm-verity: reduce stack usage for recheck (Benjamin Marzinski) [RHEL-27849] - dm-crypt: recheck the integrity tag after a failure (Benjamin Marzinski) [RHEL-27849] - dm-crypt: don't modify the data when using authenticated encryption (Benjamin Marzinski) [RHEL-27849] - dm-verity: recheck the hash after a failure (Benjamin Marzinski) [RHEL-27849] - dm-integrity: recheck the integrity tag after a failure (Benjamin Marzinski) [RHEL-27849] - [rt] build kernel-rt-4.18.0-545.rt7.334.el8 [RHEL-5332] - tracing/timerlat: Move hrtimer_init to timerlat_fd open() (John Kacur) [RHEL-26667] - tracing/perf: Fix double put of trace event when init fails (Michael Petlan) [RHEL-19537] - ipvlan: Add handling of NETDEV_UP events (Hangbin Liu) [RHEL-19098] - ceph: add ceph_cap_unlink_work to fire check_caps() immediately (Xiubo Li) [RHEL-21760] - ceph: always queue a writeback when revoking the Fb caps (Xiubo Li) [RHEL-21760] - ceph: always check dir caps asynchronously (Xiubo Li) [RHEL-21760] - nfs: fix redundant readdir request after get eof (Benjamin Coddington) [RHEL-7780] - NFSv4.1: fixup use EXCHGID4_FLAG_USE_PNFS_DS for DS server (Scott Mayhew) [RHEL-7994] - NFSv4.1: fix pnfs MDS=DS session trunking (Scott Mayhew) [RHEL-7994] - NFSv4.1: fix zero value filehandle in post open getattr (Scott Mayhew) [RHEL-7994] - NFSv4.1: use EXCHGID4_FLAG_USE_PNFS_DS for DS server (Scott Mayhew) [RHEL-7994] - x86/boot: Ignore NMIs during very early boot (Valentin Schneider) [RHEL-22749] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - vfs: use READ_ONCE() to access ->i_link (Jay Shin) [RHEL-141790] - fold generic_readlink() into its only caller (Jay Shin) [RHEL-141790] - fs/proc: fix uaf in proc_readdir_de() (Pavel Reichl) [RHEL-137093] {CVE-2025-40271} - Backport 'create an empty changelog file when changing its name' (Alexandra Hájková) - mptcp: fix race condition in mptcp_schedule_work() (Paolo Abeni) [RHEL-134443] {CVE-2025-40258} - mptcp: use mptcp_schedule_work instead of open-coding it (Paolo Abeni) [RHEL-134443] - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - tcp: minor optimization in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Kamal Heib) [RHEL-134347] {CVE-2025-38022} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - Bluetooth: hci_event: call disconnect callback before deleting conn (CKI Backport Bot) [RHEL-137039] {CVE-2023-53673} - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CKI Backport Bot) [RHEL-134423] {CVE-2025-40277} - xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 (John J Coleman) [RHEL-111354] - xen: Fix x86 sched_clock() interface for xen (John J Coleman) [RHEL-111354] - x86/xen/time: Output xen sched_clock time from 0 (John J Coleman) [RHEL-111354] - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Olga Kornievskaia) [RHEL-132819] - vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139273] {CVE-2025-40248} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ignore ndlp rport mismatch in dev_loss_tmo callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Modify handling of ADISC based on ndlp state and RPI registration (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Delete NLP_TARGET_REMOVE flag due to obsolete usage (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo callback (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Check devloss callbk done flag for potential stale NDLP ptrs (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kref imbalance on fabric ndlps from dev_loss_tmo handler (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Update PRLO handling in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Add condition to delete ndlp object after sending BLS_RJT to an ABTS (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove NLP_RCV_PLOGI early return during RSCN processing for ndlps (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Allow lpfc_plogi_confirm_nport() logic to execute for Fabric nodes (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix list_entry null check warning in lpfc_cmpl_els_plogi() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix possible file string name overflow when updating firmware (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Validate ELS LS_ACC completion payload (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove extra ndlp kref decrement in FLOGI cmpl for loop topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Revise NPIV ELS unsol rcv cmpl logic to drop ndlp based on nlp_state (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix double free in lpfc_cmpl_els_logo_acc() caused by lpfc_nlp_not_used() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Move scsi_host_template outside dynamically allocated/freed phba (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fill in missing ndlp kref puts in error paths (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login (Ewan D. Milne) [RHEL-32324] - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301} - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933} - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051} - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449] - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096} - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - vfs: use READ_ONCE() to access ->i_link (Jay Shin) [RHEL-141790] - fold generic_readlink() into its only caller (Jay Shin) [RHEL-141790] - fs/proc: fix uaf in proc_readdir_de() (Pavel Reichl) [RHEL-137093] {CVE-2025-40271} - Backport 'create an empty changelog file when changing its name' (Alexandra Hájková) - mptcp: fix race condition in mptcp_schedule_work() (Paolo Abeni) [RHEL-134443] {CVE-2025-40258} - mptcp: use mptcp_schedule_work instead of open-coding it (Paolo Abeni) [RHEL-134443] - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - tcp: minor optimization in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Kamal Heib) [RHEL-134347] {CVE-2025-38022} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - vfs: use READ_ONCE() to access ->i_link (Jay Shin) [RHEL-141790] - fold generic_readlink() into its only caller (Jay Shin) [RHEL-141790] - fs/proc: fix uaf in proc_readdir_de() (Pavel Reichl) [RHEL-137093] {CVE-2025-40271} - Backport 'create an empty changelog file when changing its name' (Alexandra Hájková) - mptcp: fix race condition in mptcp_schedule_work() (Paolo Abeni) [RHEL-134443] {CVE-2025-40258} - mptcp: use mptcp_schedule_work instead of open-coding it (Paolo Abeni) [RHEL-134443] - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - tcp: minor optimization in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Kamal Heib) [RHEL-134347] {CVE-2025-38022} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - autofs: use wake_up() instead of wake_up_interruptible(() (Ian Kent) [RHEL-143685] - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Ian Kent) [RHEL-143685] {CVE-2023-54134} - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141709] - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-136693] - audit: merge loops in __audit_inode_child() (Ricardo Robaina) [RHEL-140442] - bridge: mcast: Fix use-after-free during router port configuration (Mohammad Heib) [RHEL-138422] {CVE-2025-38248} - net/sched: Enforce that teql can only be used as root qdisc (CKI Backport Bot) [RHEL-146992] {CVE-2026-23074} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Marc Milgram) [RHEL-137838] {CVE-2025-38129} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143189] {CVE-2025-68800} - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126886] {CVE-2025-40064} - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147261] {CVE-2026-23097} - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-134673] - autofs: use wake_up() instead of wake_up_interruptible(() (Ian Kent) [RHEL-143685] - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Ian Kent) [RHEL-143685] {CVE-2023-54134} - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141709] - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-136693] - audit: merge loops in __audit_inode_child() (Ricardo Robaina) [RHEL-140442] - bridge: mcast: Fix use-after-free during router port configuration (Mohammad Heib) [RHEL-138422] {CVE-2025-38248} - net/sched: Enforce that teql can only be used as root qdisc (CKI Backport Bot) [RHEL-146992] {CVE-2026-23074} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Marc Milgram) [RHEL-137838] {CVE-2025-38129} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143189] {CVE-2025-68800} - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126886] {CVE-2025-40064} - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - macvlan: fix possible UAF in macvlan_forward_source() (Hangbin Liu) [RHEL-144120] {CVE-2026-23001} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-131922] - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount (Jocelyn Falempe) [RHEL-148636] - audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd references (Waiman Long) [RHEL-146026] - fs: Add a pool of extra fs->pwd references to fs_struct (Waiman Long) [RHEL-146026] - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143535] {CVE-2025-71085} - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147261] {CVE-2026-23097} - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-134673] - autofs: use wake_up() instead of wake_up_interruptible(() (Ian Kent) [RHEL-143685] - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Ian Kent) [RHEL-143685] {CVE-2023-54134} - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141709] - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-136693] - audit: merge loops in __audit_inode_child() (Ricardo Robaina) [RHEL-140442] - bridge: mcast: Fix use-after-free during router port configuration (Mohammad Heib) [RHEL-138422] {CVE-2025-38248} - net/sched: Enforce that teql can only be used as root qdisc (CKI Backport Bot) [RHEL-146992] {CVE-2026-23074} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Marc Milgram) [RHEL-137838] {CVE-2025-38129} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143189] {CVE-2025-68800} - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126886] {CVE-2025-40064} - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - x86/microcode/AMD: Revert "Backport AMD microcode commits for better microcode loading support" (Waiman Long) [RHEL-155860] - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150398] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150398] - tcp: fix forever orphan socket caused by tcp_abort (Paolo Abeni) [RHEL-146187] - xfs: fix minimum agno handling for xfs alloc modes in RHEL8 (Brian Foster) [RHEL-102464] - xfs: fix uninitialized use of flags variable in xfs_alloc_vextent() (Brian Foster) [RHEL-102464] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82523] - tcp: use this_cpu_read(*X) instead of *this_cpu_ptr(X) (Davide Caratti) [RHEL-82523] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150221] - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150221] {CVE-2026-23209} - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) [RHEL-96016] - s390/kexec: Emit an error message when cmdline is too long (Mete Durlu) [RHEL-144946] - s390/boot: Fix kernel size in bootparm area (Mete Durlu) [RHEL-144946] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-137123] - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-151614] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove useless transaction in evict_linked_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-151614] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-151614] - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146419] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146419] {CVE-2025-38323} - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136288] - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136288] - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136288] - scsi: st: Tighten the page format heuristics with MODE SELECT (John Meneghini) [RHEL-136288] - scsi: st: ERASE does not change tape location (John Meneghini) [RHEL-136288] - scsi: st: Fix array overflow in st_setup() (John Meneghini) [RHEL-136288] - scsi: st: Add sysfs file position_lost_in_reset (John Meneghini) [RHEL-136288] - scsi: st: Modify st.c to use the new scsi_error counters (John Meneghini) [RHEL-136288] - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (John Meneghini) [RHEL-136288] - scsi: st: Restore some drive settings after reset (John Meneghini) [RHEL-136288] - scsi: st: Fix input/output error on empty drive reset (John Meneghini) [RHEL-136288] - smb: client: handle lack of IPC in dfs_cache_refresh() (Paulo Alcantara) [RHEL-138235] - smb: client: allow parsing zero-length AV pairs (Paulo Alcantara) [RHEL-138235] - cifs: reduce warning log level for server not advertising interfaces (Paulo Alcantara) [RHEL-138235] - smb: client: Fix match_session bug preventing session reuse (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of kstrdup() in get_ses_refpath() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy when tree connecting to DFS interlink targets (Paulo Alcantara) [RHEL-138235] - smb: client: don't trust DFSREF_STORAGE_SERVER bit (Paulo Alcantara) [RHEL-138235] - smb: client: don't check for @leaf_fullpath in match_server() (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of TCP_Server_Info::refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: don't retry DFS targets on server shutdown (Paulo Alcantara) [RHEL-138235] - smb: client: fix return value of parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: optimize referral walk on failed link targets (Paulo Alcantara) [RHEL-138235] - smb: client: provide dns_resolve_{unc,name} helpers (Paulo Alcantara) [RHEL-138235] - smb: client: parse DNS domain name from domain= option (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS mount against old servers with NTLMSSP (Paulo Alcantara) [RHEL-138235] - smb: client: parse av pair type 4 in CHALLENGE_MESSAGE (Paulo Alcantara) [RHEL-138235] - smb: client: introduce av_for_each_entry() helper (Paulo Alcantara) [RHEL-138235] - smb: client: fix double free of TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-138235] {CVE-2025-21673} - smb: client: fix potential race in cifs_put_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy message when mounting shares (Paulo Alcantara) [RHEL-138235] - smb: client: don't try following DFS links in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow reconnect when sending ioctl (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of @nlsc param in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow more DFS referrals to be cached (Paulo Alcantara) [RHEL-138235] - smb: client: propagate error from cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS failover in multiuser mounts (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS interlink failover (Paulo Alcantara) [RHEL-138235] - smb: client: improve purging of cached referrals (Paulo Alcantara) [RHEL-138235] - smb: client: avoid unnecessary reconnects when refreshing referrals (Paulo Alcantara) [RHEL-138235] - smb: client: serialise cifs_construct_tcon() with cifs_mount_mutex (Paulo Alcantara) [RHEL-138235] - smb: client: handle DFS tcons in cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: refresh referral without acquiring refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: guarantee refcounted children from parent session (Paulo Alcantara) [RHEL-138235] {CVE-2024-35869} - smb: client: set correct id, uid and cruid for multiuser automounts (Paulo Alcantara) [RHEL-138235] {CVE-2024-26822} - cifs: change tcon status when need_reconnect is set on it (Paulo Alcantara) [RHEL-138235] - smb: client: fix potential NULL deref in parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: fix mount when dns_resolver key is not available (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs code dep in namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs naming in automount code (Paulo Alcantara) [RHEL-138235] - smb: client: rename cifs_dfs_ref.c to namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: ensure to try all targets when finding nested links (Paulo Alcantara) [RHEL-138235] - smb: client: introduce DFS_CACHE_TGT_LIST() (Paulo Alcantara) [RHEL-138235] - smb: client: fix null auth (Paulo Alcantara) [RHEL-138235] - smb: client: fix dfs link mount against w2k8 (Paulo Alcantara) [RHEL-138235] - cifs: fix charset issue in reconnection (Paulo Alcantara) [RHEL-138235] - smb: client: fix missed ses refcounting (Paulo Alcantara) [RHEL-138235] {CVE-2023-54076} - fs/nls: make load_nls() take a const parameter (Paulo Alcantara) [RHEL-138235] - smb: client: remove redundant pointer 'server' (Paulo Alcantara) [RHEL-138235] - smb: client: improve DFS mount check (Paulo Alcantara) [RHEL-138235] - smb: client: fix shared DFS root mounts with different prefixes (Paulo Alcantara) [RHEL-138235] - smb: client: fix parsing of source mount option (Paulo Alcantara) [RHEL-138235] - smb: client: fix warning in cifs_match_super() (Paulo Alcantara) [RHEL-138235] - cifs: fix max_credits implementation (Paulo Alcantara) [RHEL-138235] - cifs: fix sockaddr comparison in iface_cmp (Paulo Alcantara) [RHEL-138235] - cifs: fix status checks in cifs_tree_connect (Paulo Alcantara) [RHEL-138235] - cifs: fix smb1 mount regression (Paulo Alcantara) [RHEL-138235] - cifs: fix sharing of DFS connections (Paulo Alcantara) [RHEL-138235] - cifs: avoid potential races when handling multiple dfs tcons (Paulo Alcantara) [RHEL-138235] - cifs: protect access of TCP_Server_Info::{origin,leaf}_fullpath (Paulo Alcantara) [RHEL-138235] - cifs: avoid dup prefix path in dfs_get_automount_devname() (Paulo Alcantara) [RHEL-138235] - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL (Paulo Alcantara) [RHEL-138235] {CVE-2023-53246} - smb3: fix unusable share after force unmount failure (Paulo Alcantara) [RHEL-138235] - cifs: check only tcon status on tcon related functions (Paulo Alcantara) [RHEL-138235] - cifs: return DFS root session id in DebugData (Paulo Alcantara) [RHEL-138235] - cifs: fix use-after-free bug in refresh_cache_worker() (Paulo Alcantara) [RHEL-138235] {CVE-2023-53052} - cifs: set DFS root session in cifs_get_smb_ses() (Paulo Alcantara) [RHEL-138235] - cifs: remove unused function (Paulo Alcantara) [RHEL-138235] - cifs: remove duplicate code in __refresh_tcon() (Paulo Alcantara) [RHEL-138235] - cifs: remove redundant assignment to the variable match (Paulo Alcantara) [RHEL-138235] - cifs: use origin fullpath for automounts (Paulo Alcantara) [RHEL-138235] - cifs: fix source pathname comparison of dfs supers (Paulo Alcantara) [RHEL-138235] - cifs: fix confusing debug message (Paulo Alcantara) [RHEL-138235] - cifs: don't block in dfs_cache_noreq_update_tgthint() (Paulo Alcantara) [RHEL-138235] - cifs: refresh root referrals (Paulo Alcantara) [RHEL-138235] - cifs: fix refresh of cached referrals (Paulo Alcantara) [RHEL-138235] - cifs: share dfs connections and supers (Paulo Alcantara) [RHEL-138235] - cifs: split out ses and tcon retrieval from mount_get_conns() (Paulo Alcantara) [RHEL-138235] - cifs: set resolved ip in sockaddr (Paulo Alcantara) [RHEL-138235] - cifs: remove unused smb3_fs_context::mount_options (Paulo Alcantara) [RHEL-138235] - cifs: get rid of mount options string parsing (Paulo Alcantara) [RHEL-138235] - cifs: use fs_context for automounts (Paulo Alcantara) [RHEL-138235] - cifs: remove various function description warnings (Paulo Alcantara) [RHEL-138235] - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Select which microcode patch to load (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add more known models to entry sign checking (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Limit Entrysign signature checking to known generations (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use sha256() instead of init/update/final (Waiman Long) [RHEL-132479] - x86/microcode: Fix Entrysign revision check for Zen1/Naples (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Handle the case of no BIOS microcode (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add some forgotten models to the SHA check (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Load only SHA256-checksummed patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add get_patch_level() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Merge early_apply_microcode() into its single callsite (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Have __apply_microcode_amd() return bool (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Flush patch buffer mapping after application (Waiman Long) [RHEL-132479] - x86/mm: Carve out INVLPG inline asm for use by others (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Split load_microcode_amd() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Pay attention to the stepping dynamically (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix a -Wsometimes-uninitialized clang false positive (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use the family,model,stepping encoded in the patch ID (Waiman Long) [RHEL-132479] - x86/microcode/amd: Cache builtin microcode too (Waiman Long) [RHEL-132479] - x86/microcode/amd: Use correct per CPU ucode_cpu_info (Waiman Long) [RHEL-132479] - x86/microcode/amd: Remove X86_32 specific code in early_apply_microcode() & get_builtin_microcode() (Waiman Long) [RHEL-132479] - x86/microcode: Move core specific defines to local header (Waiman Long) [RHEL-132479] - x86/microcode/intel: Rename get_datasize() since its used externally (Waiman Long) [RHEL-132479] - x86/microcode: Make reload_early_microcode() static (Waiman Long) [RHEL-132479] - x86/microcode: Include vendor headers into microcode.h (Waiman Long) [RHEL-132479] - x86/microcode/intel: Move microcode functions out of cpu/intel.c (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Get rid of __find_equiv_id() (Waiman Long) [RHEL-132479] - x86/microcode: Add explicit CPU vendor dependency (Waiman Long) [RHEL-132479] - macvlan: fix possible UAF in macvlan_forward_source() (Hangbin Liu) [RHEL-144120] {CVE-2026-23001} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-131922] - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount (Jocelyn Falempe) [RHEL-148636] - audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd references (Waiman Long) [RHEL-146026] - fs: Add a pool of extra fs->pwd references to fs_struct (Waiman Long) [RHEL-146026] - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143535] {CVE-2025-71085} - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147261] {CVE-2026-23097} - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-134673] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930] - NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242] - pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242] - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242] - NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242] - NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242] - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242] - SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242] - NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242] - SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242] - SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242] - SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242] - SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242] - NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242] - NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419] - nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419] - pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419] - NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419] - NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419] - NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419] - NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419] - NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419] - NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419] - NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419] - NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419] - NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419] - nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419] - nfs: always check dreq->error after a commit (Mike Snitzer) [RHEL-156419] - nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419] - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231} - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942] - x86/microcode/AMD: Revert "Backport AMD microcode commits for better microcode loading support" (Waiman Long) [RHEL-155860] - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150398] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150398] - tcp: fix forever orphan socket caused by tcp_abort (Paolo Abeni) [RHEL-146187] - xfs: fix minimum agno handling for xfs alloc modes in RHEL8 (Brian Foster) [RHEL-102464] - xfs: fix uninitialized use of flags variable in xfs_alloc_vextent() (Brian Foster) [RHEL-102464] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82523] - tcp: use this_cpu_read(*X) instead of *this_cpu_ptr(X) (Davide Caratti) [RHEL-82523] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150221] - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150221] {CVE-2026-23209} - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) [RHEL-96016] - s390/kexec: Emit an error message when cmdline is too long (Mete Durlu) [RHEL-144946] - s390/boot: Fix kernel size in bootparm area (Mete Durlu) [RHEL-144946] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-137123] - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-151614] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove useless transaction in evict_linked_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-151614] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-151614] - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146419] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146419] {CVE-2025-38323} - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136288] - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136288] - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136288] - scsi: st: Tighten the page format heuristics with MODE SELECT (John Meneghini) [RHEL-136288] - scsi: st: ERASE does not change tape location (John Meneghini) [RHEL-136288] - scsi: st: Fix array overflow in st_setup() (John Meneghini) [RHEL-136288] - scsi: st: Add sysfs file position_lost_in_reset (John Meneghini) [RHEL-136288] - scsi: st: Modify st.c to use the new scsi_error counters (John Meneghini) [RHEL-136288] - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (John Meneghini) [RHEL-136288] - scsi: st: Restore some drive settings after reset (John Meneghini) [RHEL-136288] - scsi: st: Fix input/output error on empty drive reset (John Meneghini) [RHEL-136288] - smb: client: handle lack of IPC in dfs_cache_refresh() (Paulo Alcantara) [RHEL-138235] - smb: client: allow parsing zero-length AV pairs (Paulo Alcantara) [RHEL-138235] - cifs: reduce warning log level for server not advertising interfaces (Paulo Alcantara) [RHEL-138235] - smb: client: Fix match_session bug preventing session reuse (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of kstrdup() in get_ses_refpath() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy when tree connecting to DFS interlink targets (Paulo Alcantara) [RHEL-138235] - smb: client: don't trust DFSREF_STORAGE_SERVER bit (Paulo Alcantara) [RHEL-138235] - smb: client: don't check for @leaf_fullpath in match_server() (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of TCP_Server_Info::refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: don't retry DFS targets on server shutdown (Paulo Alcantara) [RHEL-138235] - smb: client: fix return value of parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: optimize referral walk on failed link targets (Paulo Alcantara) [RHEL-138235] - smb: client: provide dns_resolve_{unc,name} helpers (Paulo Alcantara) [RHEL-138235] - smb: client: parse DNS domain name from domain= option (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS mount against old servers with NTLMSSP (Paulo Alcantara) [RHEL-138235] - smb: client: parse av pair type 4 in CHALLENGE_MESSAGE (Paulo Alcantara) [RHEL-138235] - smb: client: introduce av_for_each_entry() helper (Paulo Alcantara) [RHEL-138235] - smb: client: fix double free of TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-138235] {CVE-2025-21673} - smb: client: fix potential race in cifs_put_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy message when mounting shares (Paulo Alcantara) [RHEL-138235] - smb: client: don't try following DFS links in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow reconnect when sending ioctl (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of @nlsc param in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow more DFS referrals to be cached (Paulo Alcantara) [RHEL-138235] - smb: client: propagate error from cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS failover in multiuser mounts (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS interlink failover (Paulo Alcantara) [RHEL-138235] - smb: client: improve purging of cached referrals (Paulo Alcantara) [RHEL-138235] - smb: client: avoid unnecessary reconnects when refreshing referrals (Paulo Alcantara) [RHEL-138235] - smb: client: serialise cifs_construct_tcon() with cifs_mount_mutex (Paulo Alcantara) [RHEL-138235] - smb: client: handle DFS tcons in cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: refresh referral without acquiring refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: guarantee refcounted children from parent session (Paulo Alcantara) [RHEL-138235] {CVE-2024-35869} - smb: client: set correct id, uid and cruid for multiuser automounts (Paulo Alcantara) [RHEL-138235] {CVE-2024-26822} - cifs: change tcon status when need_reconnect is set on it (Paulo Alcantara) [RHEL-138235] - smb: client: fix potential NULL deref in parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: fix mount when dns_resolver key is not available (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs code dep in namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs naming in automount code (Paulo Alcantara) [RHEL-138235] - smb: client: rename cifs_dfs_ref.c to namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: ensure to try all targets when finding nested links (Paulo Alcantara) [RHEL-138235] - smb: client: introduce DFS_CACHE_TGT_LIST() (Paulo Alcantara) [RHEL-138235] - smb: client: fix null auth (Paulo Alcantara) [RHEL-138235] - smb: client: fix dfs link mount against w2k8 (Paulo Alcantara) [RHEL-138235] - cifs: fix charset issue in reconnection (Paulo Alcantara) [RHEL-138235] - smb: client: fix missed ses refcounting (Paulo Alcantara) [RHEL-138235] {CVE-2023-54076} - fs/nls: make load_nls() take a const parameter (Paulo Alcantara) [RHEL-138235] - smb: client: remove redundant pointer 'server' (Paulo Alcantara) [RHEL-138235] - smb: client: improve DFS mount check (Paulo Alcantara) [RHEL-138235] - smb: client: fix shared DFS root mounts with different prefixes (Paulo Alcantara) [RHEL-138235] - smb: client: fix parsing of source mount option (Paulo Alcantara) [RHEL-138235] - smb: client: fix warning in cifs_match_super() (Paulo Alcantara) [RHEL-138235] - cifs: fix max_credits implementation (Paulo Alcantara) [RHEL-138235] - cifs: fix sockaddr comparison in iface_cmp (Paulo Alcantara) [RHEL-138235] - cifs: fix status checks in cifs_tree_connect (Paulo Alcantara) [RHEL-138235] - cifs: fix smb1 mount regression (Paulo Alcantara) [RHEL-138235] - cifs: fix sharing of DFS connections (Paulo Alcantara) [RHEL-138235] - cifs: avoid potential races when handling multiple dfs tcons (Paulo Alcantara) [RHEL-138235] - cifs: protect access of TCP_Server_Info::{origin,leaf}_fullpath (Paulo Alcantara) [RHEL-138235] - cifs: avoid dup prefix path in dfs_get_automount_devname() (Paulo Alcantara) [RHEL-138235] - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL (Paulo Alcantara) [RHEL-138235] {CVE-2023-53246} - smb3: fix unusable share after force unmount failure (Paulo Alcantara) [RHEL-138235] - cifs: check only tcon status on tcon related functions (Paulo Alcantara) [RHEL-138235] - cifs: return DFS root session id in DebugData (Paulo Alcantara) [RHEL-138235] - cifs: fix use-after-free bug in refresh_cache_worker() (Paulo Alcantara) [RHEL-138235] {CVE-2023-53052} - cifs: set DFS root session in cifs_get_smb_ses() (Paulo Alcantara) [RHEL-138235] - cifs: remove unused function (Paulo Alcantara) [RHEL-138235] - cifs: remove duplicate code in __refresh_tcon() (Paulo Alcantara) [RHEL-138235] - cifs: remove redundant assignment to the variable match (Paulo Alcantara) [RHEL-138235] - cifs: use origin fullpath for automounts (Paulo Alcantara) [RHEL-138235] - cifs: fix source pathname comparison of dfs supers (Paulo Alcantara) [RHEL-138235] - cifs: fix confusing debug message (Paulo Alcantara) [RHEL-138235] - cifs: don't block in dfs_cache_noreq_update_tgthint() (Paulo Alcantara) [RHEL-138235] - cifs: refresh root referrals (Paulo Alcantara) [RHEL-138235] - cifs: fix refresh of cached referrals (Paulo Alcantara) [RHEL-138235] - cifs: share dfs connections and supers (Paulo Alcantara) [RHEL-138235] - cifs: split out ses and tcon retrieval from mount_get_conns() (Paulo Alcantara) [RHEL-138235] - cifs: set resolved ip in sockaddr (Paulo Alcantara) [RHEL-138235] - cifs: remove unused smb3_fs_context::mount_options (Paulo Alcantara) [RHEL-138235] - cifs: get rid of mount options string parsing (Paulo Alcantara) [RHEL-138235] - cifs: use fs_context for automounts (Paulo Alcantara) [RHEL-138235] - cifs: remove various function description warnings (Paulo Alcantara) [RHEL-138235] - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Select which microcode patch to load (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add more known models to entry sign checking (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Limit Entrysign signature checking to known generations (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use sha256() instead of init/update/final (Waiman Long) [RHEL-132479] - x86/microcode: Fix Entrysign revision check for Zen1/Naples (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Handle the case of no BIOS microcode (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add some forgotten models to the SHA check (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Load only SHA256-checksummed patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add get_patch_level() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Merge early_apply_microcode() into its single callsite (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Have __apply_microcode_amd() return bool (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Flush patch buffer mapping after application (Waiman Long) [RHEL-132479] - x86/mm: Carve out INVLPG inline asm for use by others (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Split load_microcode_amd() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Pay attention to the stepping dynamically (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix a -Wsometimes-uninitialized clang false positive (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use the family,model,stepping encoded in the patch ID (Waiman Long) [RHEL-132479] - x86/microcode/amd: Cache builtin microcode too (Waiman Long) [RHEL-132479] - x86/microcode/amd: Use correct per CPU ucode_cpu_info (Waiman Long) [RHEL-132479] - x86/microcode/amd: Remove X86_32 specific code in early_apply_microcode() & get_builtin_microcode() (Waiman Long) [RHEL-132479] - x86/microcode: Move core specific defines to local header (Waiman Long) [RHEL-132479] - x86/microcode/intel: Rename get_datasize() since its used externally (Waiman Long) [RHEL-132479] - x86/microcode: Make reload_early_microcode() static (Waiman Long) [RHEL-132479] - x86/microcode: Include vendor headers into microcode.h (Waiman Long) [RHEL-132479] - x86/microcode/intel: Move microcode functions out of cpu/intel.c (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Get rid of __find_equiv_id() (Waiman Long) [RHEL-132479] - x86/microcode: Add explicit CPU vendor dependency (Waiman Long) [RHEL-132479] - macvlan: fix possible UAF in macvlan_forward_source() (Hangbin Liu) [RHEL-144120] {CVE-2026-23001} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-131922] - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount (Jocelyn Falempe) [RHEL-148636] - audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd references (Waiman Long) [RHEL-146026] - fs: Add a pool of extra fs->pwd references to fs_struct (Waiman Long) [RHEL-146026] - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143535] {CVE-2025-71085} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930] - NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242] - pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242] - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242] - NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242] - NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242] - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242] - SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242] - NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242] - SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242] - SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242] - SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242] - SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242] - NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242] - NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419] - nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419] - pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419] - NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419] - NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419] - NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419] - NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419] - NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419] - NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419] - NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419] - NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419] - NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419] - nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419] - nfs: always check dreq->error after a commit (Mike Snitzer) [RHEL-156419] - nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419] - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231} - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942] - x86/microcode/AMD: Revert "Backport AMD microcode commits for better microcode loading support" (Waiman Long) [RHEL-155860] - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150398] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150398] - tcp: fix forever orphan socket caused by tcp_abort (Paolo Abeni) [RHEL-146187] - xfs: fix minimum agno handling for xfs alloc modes in RHEL8 (Brian Foster) [RHEL-102464] - xfs: fix uninitialized use of flags variable in xfs_alloc_vextent() (Brian Foster) [RHEL-102464] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82523] - tcp: use this_cpu_read(*X) instead of *this_cpu_ptr(X) (Davide Caratti) [RHEL-82523] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150221] - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150221] {CVE-2026-23209} - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) [RHEL-96016] - s390/kexec: Emit an error message when cmdline is too long (Mete Durlu) [RHEL-144946] - s390/boot: Fix kernel size in bootparm area (Mete Durlu) [RHEL-144946] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-137123] - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-151614] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove useless transaction in evict_linked_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-151614] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-151614] - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146419] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146419] {CVE-2025-38323} - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136288] - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136288] - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136288] - scsi: st: Tighten the page format heuristics with MODE SELECT (John Meneghini) [RHEL-136288] - scsi: st: ERASE does not change tape location (John Meneghini) [RHEL-136288] - scsi: st: Fix array overflow in st_setup() (John Meneghini) [RHEL-136288] - scsi: st: Add sysfs file position_lost_in_reset (John Meneghini) [RHEL-136288] - scsi: st: Modify st.c to use the new scsi_error counters (John Meneghini) [RHEL-136288] - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (John Meneghini) [RHEL-136288] - scsi: st: Restore some drive settings after reset (John Meneghini) [RHEL-136288] - scsi: st: Fix input/output error on empty drive reset (John Meneghini) [RHEL-136288] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930] - NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242] - pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242] - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242] - NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242] - NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242] - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242] - SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242] - NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242] - SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242] - SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242] - SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242] - SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242] - NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242] - NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419] - nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419] - pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419] - NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419] - NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419] - NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419] - NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419] - NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419] - NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419] - NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419] - NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419] - NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419] - nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419] - nfs: always check dreq->error after a commit (Mike Snitzer) [RHEL-156419] - nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419] - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231} - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942] - xfrm: esp: avoid in-place decrypt on shared skb frags - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772] - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772] - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772] - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772] - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772] - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772] - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709} - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815] - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815] - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815] - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190} - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408} - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684} - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032] - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032] - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032] - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032] - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032] - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032] - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032] - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032] - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032] - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183} - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219] - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219] - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219] - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219] - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219] - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219] - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219] - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347} - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243} - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890] - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890] - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890] - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890] - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890] - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890] - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890] - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613} - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961] - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858} - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392} - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781} - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990} - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772] - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772] - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772] - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772] - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772] - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772] - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709} - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815] - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815] - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815] - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190} - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408} - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684} - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032] - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032] - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032] - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032] - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032] - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032] - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032] - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032] - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032] - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183} - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219] - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219] - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219] - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219] - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219] - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219] - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219] - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347} - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243} - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890] - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890] - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890] - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890] - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890] - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890] - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890] - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613} - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961] - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858} - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392} - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781} - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990} - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772] - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772] - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772] - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772] - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772] - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772] - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709} - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815] - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815] - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815] - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190} - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408} - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684} - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032] - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032] - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032] - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032] - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032] - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032] - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032] - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032] - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032] - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183} - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219] - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219] - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219] - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219] - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219] - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219] - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219] - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347} - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243} - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890] - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890] - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890] - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890] - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890] - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890] - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890] - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613} - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961] - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858} - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392} - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781} - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - [rt] build kernel-rt-4.18.0-553.16.1.rt7.357.el8_10 [RHEL-44553] - x86/bhi: Fix incorrect CLEAR_BRANCH_HISTORY position in entry_INT80_compat (Waiman Long) [RHEL-50648] - [rt] build kernel-rt-4.18.0-553.15.1.rt7.356.el8_10 [RHEL-44553] - Revert "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-44613] - ionic: fix use after netif_napi_del() (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - ionic: clean interrupt before enabling queue to avoid credit race (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change (CKI Backport Bot) [RHEL-49321] {CVE-2021-47624} - xhci: Handle TD clearing for multiple streams case (CKI Backport Bot) [RHEL-47882] {CVE-2024-40927} - net: openvswitch: Fix Use-After-Free in ovs_ct_exit (cki-backport-bot) [RHEL-36362] {CVE-2024-27395} - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: fix vlan use-after-free (cki-backport-bot) [RHEL-43721] {CVE-2024-36979} - irqchip/gic-v3-its: Prevent double free on error (Charles Mirabile) [RHEL-37022] {CVE-2024-35847} - irqchip/gic-v3-its: Fix potential VPE leak on error (Charles Mirabile) [RHEL-37744] {CVE-2021-47373} - i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() (Charles Mirabile) [RHEL-34735] {CVE-2022-48632} - iommu/dma: fix zeroing of bounce buffer padding used by untrusted devices (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: remove alloc_size argument to swiotlb_tbl_map_single() (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: fix swiotlb_bounce() to do partial sync's correctly (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Reinstate page-alignment for mappings >= PAGE_SIZE (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix alignment checks when both allocation and DMA masks are present (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix double-allocation of slots due to broken alignment handling (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (cki-backport-bot) [RHEL-44441] {CVE-2024-31076} - [rt] build kernel-rt-4.18.0-553.14.1.rt7.355.el8_10 [RHEL-44553] - s390/qeth: Fix kernel panic after setting hsuid (Mete Durlu) [RHEL-49754] - perf/core: Protect event sibling list locking against interrupt inversion (Daniel Vacek) [RHEL-31798] - vt: fix unicode buffer corruption when deleting characters (Steve Best) [RHEL-36936] {CVE-2024-35823} - cifs: translate network errors on send to -ECONNABORTED (Paulo Alcantara) [RHEL-36754] - xfs: don't block in busy flushing when freeing extents (Brian Foster) [RHEL-7984] - xfs: allow extent free intents to be retried (Brian Foster) [RHEL-7984] - xfs: pass alloc flags through to xfs_extent_busy_flush() (Brian Foster) [RHEL-7984] - xfs: use deferred frees for btree block freeing (Brian Foster) [RHEL-7984] - xfs: fix bounds check in xfs_defer_agfl_block() (Brian Foster) [RHEL-7984] - xfs: validate block number being freed before adding to xefi (Brian Foster) [RHEL-7984] - xfs: rename xfs_bmap_add_free to xfs_free_extent_later (Brian Foster) [RHEL-7984] - usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (Desnes Nunes) [RHEL-36803] {CVE-2024-35790} - stm class: Fix a double free in stm_register_device() (Steve Best) [RHEL-44514] {CVE-2024-38627} - s390/qeth: Fix potential loss of L3-IP@ in case of network issues (Mete Durlu) [RHEL-49755] - tls: fix missing memory barrier in tls_init (cki-backport-bot) [RHEL-44471] {CVE-2024-36489} - xfs: fix log recovery buffer allocation for the legacy h_size fixup (Bill O'Donnell) [RHEL-46473] {CVE-2024-39472} - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: use __for_each_thread() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - exit: Use the correct exit_code in /proc/<pid>/stat (Brian Foster) [RHEL-31562] {CVE-2024-26686} - scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool (Ewan D. Milne) [RHEL-38283] {CVE-2023-52811} - scsi: qla2xxx: Fix double free of fcport (Ewan D. Milne) [RHEL-39549] {CVE-2024-26929} - scsi: qla2xxx: Fix double free of the ha->vp_map pointer (Ewan D. Milne) [RHEL-39549] {CVE-2024-26930} - scsi: qla2xxx: Fix command flush on cable pull (Ewan D. Milne) [RHEL-39549] {CVE-2024-26931} - [rt] build kernel-rt-4.18.0-553.13.1.rt7.354.el8_10 [RHEL-44553] - redhat: remove handling of deleted rhdocs/ directory from genspec.sh (Denys Vlasenko) - x86/bugs: Fix BHI retpoline check (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI handling of RRSBA (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr' (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI documentation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix return type of spectre_bhi_state() (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Make CONFIG_SPECTRE_BHI_ON the default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Mitigate KVM by default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add BHI mitigation knob (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Enumerate Branch History Injection (BHI) bug (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Define SPEC_CTRL_BHI_DIS_S (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add support for clearing branch history at syscall entry (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file (Waiman Long) [RHEL-28202] - perf/x86/amd/lbr: Use freeze based on availability (Waiman Long) [RHEL-28202] - Documentation/kernel-parameters: Add spec_rstack_overflow to mitigations=off (Waiman Long) [RHEL-28202] - KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace (Waiman Long) [RHEL-28202] - x86/bugs: Reset speculation control settings on init (Waiman Long) [RHEL-28202] - KVM: x86: Update KVM-only leaf handling to allow for 100% KVM-only leafs (Waiman Long) [RHEL-28202] - KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest (Waiman Long) [RHEL-28202] - mptcp: ensure snd_nxt is properly initialized on connect (Davide Caratti) [RHEL-39865] {CVE-2024-36889} - powerpc/pseries: Enforce hcall result buffer validity and size (Mamatha Inamdar) [RHEL-48291] {CVE-2024-40974} - wifi: mac80211: fix potential key use-after-free (Jose Ignacio Tornos Martinez) [RHEL-28007] {CVE-2023-52530} - cppc_cpufreq: Fix possible null pointer dereference (Mark Langsdorf) [RHEL-44137] {CVE-2024-38573} - net/sched: act_mirred: use the backlog for mirred ingress (Davide Caratti) [RHEL-31718] {CVE-2024-26740} - vfio/pci: Lock external INTx masking ops (Alex Williamson) [RHEL-31922] {CVE-2024-26810} - net: sched: sch_multiq: fix possible OOB write in multiq_tune() (Davide Caratti) [RHEL-43464] {CVE-2024-36978} - tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized (Guillaume Nault) [RHEL-37850] {CVE-2021-47304} - pstore/ram: Fix crash when setting number of cpus to an odd number (Lenny Szubowicz) [RHEL-29471] {CVE-2023-52619} - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node (Jocelyn Falempe) [RHEL-37101] {CVE-2023-52662} - drm/vmwgfx: Fix the lifetime of the bo cursor memory (Jocelyn Falempe) [RHEL-36962] {CVE-2024-35810} - drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed (Jocelyn Falempe) [RHEL-34987] {CVE-2024-26940} - drm/vmwgfx: Unmap the surface before resetting it on a plane state (Jocelyn Falempe) [RHEL-35217] {CVE-2023-52648} - drm/vmwgfx: Fix invalid reads in fence signaled events (Jocelyn Falempe) [RHEL-40010] {CVE-2024-36960} - block: Fix wrong offset in bio_truncate() (Ming Lei) [RHEL-43782] {CVE-2022-48747} - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CKI Backport Bot) [RHEL-46913] {CVE-2024-39487} - net: fix __dst_negative_advice() race (Xin Long) [RHEL-41183] {CVE-2024-36971} - igc: avoid returning frame twice in XDP_REDIRECT (Corinna Vinschen) [RHEL-33264] {CVE-2024-26853} - mac802154: fix llsec key resources release in mac802154_llsec_key_del (Steve Best) [RHEL-34967] {CVE-2024-26961} - cpufreq: exit() callback is optional (Mark Langsdorf) [RHEL-43840] {CVE-2024-38615} - cifs: prevent infinite recursion in CIFSGetDFSRefer() (Paulo Alcantara) [RHEL-34672] - cifs: lock chan_lock outside match_session (Paulo Alcantara) [RHEL-34672] - smb3: workaround negprot bug in some Samba servers (Paulo Alcantara) [RHEL-34672] - smb3: use netname when available on secondary channels (Paulo Alcantara) [RHEL-34672] - smb3: fix empty netname context on secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: populate empty hostnames for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: always iterate smb sessions using primary channel (Paulo Alcantara) [RHEL-34672] - cifs: Fix connections leak when tlink setup failed (Paulo Alcantara) [RHEL-34672] - cifs: Fix memory leak when build ntlmssp negotiate blob failed (Paulo Alcantara) [RHEL-34672] - cifs: always initialize struct msghdr smb_msg completely (Paulo Alcantara) [RHEL-34672] - cifs: don't send down the destination address to sendmsg for a SOCK_STREAM (Paulo Alcantara) [RHEL-34672] - cifs: revalidate mapping when doing direct writes (Paulo Alcantara) [RHEL-34672] - cifs: skip extra NULL byte in filenames (Paulo Alcantara) [RHEL-34672] - cifs: list_for_each() -> list_for_each_entry() (Paulo Alcantara) [RHEL-34672] - smb2: small refactor in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - cifs: Fix crash on unload of cifs_arc4.ko (Paulo Alcantara) [RHEL-34672] - cifs: remove check of list iterator against head past the loop body (Paulo Alcantara) [RHEL-34672] - cifs: fix reconnect on smb3 mount types (Paulo Alcantara) [RHEL-34672] - cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (Paulo Alcantara) [RHEL-34672] - cifs: skip trailing separators of prefix paths (Paulo Alcantara) [RHEL-34672] - cifs: fix ntlmssp on old servers (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL ptr dereference in refresh_mounts() (Paulo Alcantara) [RHEL-34672] - cifs: do not skip link targets when an I/O fails (Paulo Alcantara) [RHEL-34672] - cifs: fix confusing unneeded warning message on smb2.1 and earlier (Paulo Alcantara) [RHEL-34672] - smb3: fix snapshot mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix workstation_name for multiuser mounts (Paulo Alcantara) [RHEL-34672] - cifs: alloc_path_with_tree_prefix: do not append sep. if the path is empty (Paulo Alcantara) [RHEL-34672] - cifs: free ntlmsspblob allocated in negotiate (Paulo Alcantara) [RHEL-34672] - cifs: avoid use of dstaddr as key for fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: add server conn_id to fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: fix missed refcounting of ipc tcon (Paulo Alcantara) [RHEL-34672] - smb2: clarify rc initialization in smb2_reconnect (Paulo Alcantara) [RHEL-34672] - cifs: populate server_hostname for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should be set on new server (Paulo Alcantara) [RHEL-34672] - cifs: introduce cifs_ses_mark_for_reconnect() helper (Paulo Alcantara) [RHEL-34672] - cifs: protect srv_count with cifs_tcp_ses_lock (Paulo Alcantara) [RHEL-34672] - cifs: move debug print out of spinlock (Paulo Alcantara) [RHEL-34672] - cifs: do not duplicate fscache cookie for secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: connect individual channel servers to primary channel server (Paulo Alcantara) [RHEL-34672] - cifs: protect session channel fields with chan_lock (Paulo Alcantara) [RHEL-34672] - cifs: do not negotiate session if session already exists (Paulo Alcantara) [RHEL-34672] - smb3: do not setup the fscache_super_cookie until fsinfo initialized (Paulo Alcantara) [RHEL-34672] - cifs: fix potential use-after-free bugs (Paulo Alcantara) [RHEL-34672] - cifs: release lock earlier in dequeue_mid error case (Paulo Alcantara) [RHEL-34672] - smb3: remove trivial dfs compile warning (Paulo Alcantara) [RHEL-34672] - cifs: support nested dfs links over reconnect (Paulo Alcantara) [RHEL-34672] - cifs: for compound requests, use open handle if possible (Paulo Alcantara) [RHEL-34672] - cifs: split out dfs code from cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant (Paulo Alcantara) [RHEL-34672] - cifs: introduce new helper for cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: fix print of hdr_flags in dfscache_proc_show() (Paulo Alcantara) [RHEL-34672] - cifs: send workstation name during ntlmssp session setup (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should not share socket with future sessions (Paulo Alcantara) [RHEL-34672] - smb3: add dynamic trace points for socket connection (Paulo Alcantara) [RHEL-34672] - cifs: Move SMB2_Create definitions to the shared area (Paulo Alcantara) [RHEL-34672] - cifs: Move more definitions into the shared area (Paulo Alcantara) [RHEL-34672] - cifs: move NEGOTIATE_PROTOCOL definitions out into the common area (Paulo Alcantara) [RHEL-34672] - cifs: Create a new shared file holding smb2 pdu definitions (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect check for null pointer in header_assemble (Paulo Alcantara) [RHEL-34672] - smb3: correct server pointer dereferencing check to be more consistent (Paulo Alcantara) [RHEL-34672] - cifs: Deal with some warnings from W=1 (Paulo Alcantara) [RHEL-34672] - cifs: fix a sign extension bug (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect kernel doc comments (Paulo Alcantara) [RHEL-34672] - cifs: remove pathname for file from SPDX header (Paulo Alcantara) [RHEL-34672] - cifs: move SMB FSCTL definitions to common code (Paulo Alcantara) [RHEL-34672] - cifs: rename cifs_common to smbfs_common (Paulo Alcantara) [RHEL-34672] - cifs: update FSCTL definitions (Paulo Alcantara) [RHEL-34672] - cifs: cifs_md4 convert to SPDX identifier (Paulo Alcantara) [RHEL-34672] - cifs: create a MD4 module and switch cifs.ko to use it (Paulo Alcantara) [RHEL-34672] - cifs: fork arc4 and create a separate module for it for cifs and other users (Paulo Alcantara) [RHEL-34672] - smb3: fix posix extensions mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix wrong release in sess_alloc_buffer() failed path (Paulo Alcantara) [RHEL-34672] - CIFS: Fix a potencially linear read overflow (Paulo Alcantara) [RHEL-34672] - cifs: use the correct max-length for dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: create sd context must be a multiple of 8 (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp sessions of dfs connections (Paulo Alcantara) [RHEL-34672] - cifs: added WARN_ON for all the count decrements (Paulo Alcantara) [RHEL-34672] - cifs: fix missing null session check in mount (Paulo Alcantara) [RHEL-34672] - cifs: handle reconnect of tcon when there is no cached dfs referral (Paulo Alcantara) [RHEL-34672] - cifs: fix the out of range assignment to bit fields in parse_server_interfaces (Paulo Alcantara) [RHEL-34672] - smb3: fix typo in header file (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: Add support for negotiating signing algorithm (Paulo Alcantara) [RHEL-34672] - cifs: prevent NULL deref in cifs_compose_mount_options() (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL dereference in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - smbdirect: missing rc checks while waiting for rdma events (Paulo Alcantara) [RHEL-34672] - cifs: Avoid field over-reading memcpy() (Paulo Alcantara) [RHEL-34672] - smb311: remove dead code for non compounded posix query info (Paulo Alcantara) [RHEL-34672] - cifs: fix SMB1 error path in cifs_get_file_info_unix (Paulo Alcantara) [RHEL-34672] - smb3: fix uninitialized value for port in witness protocol move (Paulo Alcantara) [RHEL-34672] - cifs: fix unneeded null check (Paulo Alcantara) [RHEL-34672] - cifs: use SPDX-Licence-Identifier (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in cifs_debug.c (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in smb2misc.c (Paulo Alcantara) [RHEL-34672] - cifs: missed ref-counting smb session in find (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp servers with dfs mounts (Paulo Alcantara) [RHEL-34672] - cifs: set a minimum of 2 minutes for refreshing dfs cache (Paulo Alcantara) [RHEL-34672] - cifs: Remove unused inline function is_sysvol_or_netlogon() (Paulo Alcantara) [RHEL-34672] - cifs: remove duplicated prototype (Paulo Alcantara) [RHEL-34672] - cifs: fix ipv6 formating in cifs_ses_add_channel (Paulo Alcantara) [RHEL-34672] - cifs: fix string declarations and assignments in tracepoints (Paulo Alcantara) [RHEL-34672] - cifs: fix memory leak in smb2_copychunk_range (Paulo Alcantara) [RHEL-34672] - SMB3: incorrect file id in requests compounded with open (Paulo Alcantara) [RHEL-34672] - smb3: if max_channels set to more than one channel request multichannel (Paulo Alcantara) [RHEL-34672] - smb3: do not attempt multichannel to server which does not support it (Paulo Alcantara) [RHEL-34672] - smb3: when mounting with multichannel include it in requested capabilities (Paulo Alcantara) [RHEL-34672] - cifs: simplify SWN code with dummy funcs instead of ifdefs (Paulo Alcantara) [RHEL-34672] - cifs: log mount errors using cifs_errorf() (Paulo Alcantara) [RHEL-34672] - cifs: switch build_path_from_dentry() to using dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: fix out-of-bound memory access when calling smb3_notify() at mount point (Paulo Alcantara) [RHEL-34672] - cifs: allocate buffer in the caller of build_path_from_dentry() (Paulo Alcantara) [RHEL-34672] - cifs: make build_path_from_dentry() return const char * (Paulo Alcantara) [RHEL-34672] - cifs: remove old dead code (Paulo Alcantara) [RHEL-34672] - fs: cifs: Remove repeated struct declaration (Paulo Alcantara) [RHEL-34672] - cifs: have cifs_fattr_to_inode() refuse to change type on live inode (Paulo Alcantara) [RHEL-34672] - cifs: have ->mkdir() handle race with another client sanely (Paulo Alcantara) [RHEL-34672] - do_cifs_create(): don't set ->i_mode of something we had not created (Paulo Alcantara) [RHEL-34672] - cifs: Silently ignore unknown oplock break handle (Paulo Alcantara) [RHEL-34672] - cifs: change noisy error message to FYI (Paulo Alcantara) [RHEL-34672] - cifs: print MIDs in decimal notation (Paulo Alcantara) [RHEL-34672] - cifs: minor simplification to smb2_is_network_name_deleted (Paulo Alcantara) [RHEL-34672] - TCON Reconnect during STATUS_NETWORK_NAME_DELETED (Paulo Alcantara) [RHEL-34672] - cifs: clarify hostname vs ip address in /proc/fs/cifs/DebugData (Paulo Alcantara) [RHEL-34672] - cifs: change confusing field serverName (to ip_addr) (Paulo Alcantara) [RHEL-34672] - cifs: Reformat DebugData and index connections by conn_id. (Paulo Alcantara) [RHEL-34672] - cifs: Identify a connection by a conn_id. (Paulo Alcantara) [RHEL-34672] - smb3: negotiate current dialect (SMB3.1.1) when version 3 or greater requested (Paulo Alcantara) [RHEL-34672] - smb3: Fix out-of-bounds bug in SMB2_negotiate() (Paulo Alcantara) [RHEL-34672] - fs/cifs: Simplify bool comparison. (Paulo Alcantara) [RHEL-34672] - fs/cifs: Assign boolean values to a bool variable (Paulo Alcantara) [RHEL-34672] - cifs: Avoid error pointer dereference (Paulo Alcantara) [RHEL-34672] - cifs: Re-indent cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Unlock on errors in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Delete a stray unlock in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Tracepoints and logs for tracing credit changes. (Paulo Alcantara) [RHEL-34672] - cifs: Fix some error pointers handling detected by static checker (Paulo Alcantara) [RHEL-34672] - smb3: remind users that witness protocol is experimental (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: do not log warning message if server doesn't populate salt (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: update comments clarifying SPNEGO info in negprot response (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot rsp (Paulo Alcantara) [RHEL-34672] - SMB3: avoid confusing warning message on mount to Azure (Paulo Alcantara) [RHEL-34672] - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (Nigel Croxon) [RHEL-46662] {CVE-2024-39476} - net: fix information leakage in /proc/net/ptype (Hangbin Liu) [RHEL-44000] {CVE-2022-48757} - usb: typec: ucsi: Limit read size on v1.2 (Desnes Nunes) [RHEL-37286] {CVE-2024-35924} - minmax: relax check to allow comparison between unsigned arguments and signed constants (Desnes Nunes) [RHEL-37286] - minmax: allow comparisons of 'int' against 'unsigned char/short' (Desnes Nunes) [RHEL-37286] - minmax: allow min()/max()/clamp() if the arguments have the same signedness. (Desnes Nunes) [RHEL-37286] - minmax: add umin(a, b) and umax(a, b) (Desnes Nunes) [RHEL-37286] - minmax: fix header inclusions (Desnes Nunes) [RHEL-37286] - minmax: clamp more efficiently by avoiding extra comparison (Desnes Nunes) [RHEL-37286] - minmax: sanity check constant bounds when clamping (Desnes Nunes) [RHEL-37286] - tracing: Define the is_signed_type() macro once (Desnes Nunes) [RHEL-37286] - linux/bits.h: fix compilation error with GENMASK (Desnes Nunes) [RHEL-37286] - x86/apic: Mask IOAPIC entries when disabling the local APIC (Lenny Szubowicz) [RHEL-18077] - userfaultfd: fix a race between writeprotect and exit_mmap() (Rafael Aquini) [RHEL-38410] {CVE-2021-47461} - mm: khugepaged: skip huge page collapse for special files (Waiman Long) [RHEL-38446] {CVE-2021-47491} - cachefiles: fix memory leak in cachefiles_add_cache() (Andrey Albershteyn) [RHEL-33109] {CVE-2024-26840} - drm/amd/display: Implement bounds check for stream encoder creation in DCN301 (Michel Dänzer) [RHEL-31429] {CVE-2024-26660} - net/mlx5: Discard command completions in internal error (Kamal Heib) [RHEL-44231] {CVE-2024-38555} - drm: Don't unref the same fb many times by mistake due to deadlock handling (CKI Backport Bot) [RHEL-29011] {CVE-2023-52486} - md: fix resync softlockup when bitmap size is less than array size (Nigel Croxon) [RHEL-43942] {CVE-2024-38598} - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation (Davide Caratti) [RHEL-39712] {CVE-2024-36017} - netfilter: nf_tables: discard table flag update with pending basechain deletion (Phil Sutter) [RHEL-37205] {CVE-2024-35897} - netfilter: nf_tables: reject table flag and netdev basechain updates (Phil Sutter) [RHEL-37205] - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (Ewan D. Milne) [RHEL-40172] {CVE-2024-36924} - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (Ewan D. Milne) [RHEL-40172] {CVE-2024-36952} - netfilter: nf_tables: fix memleak in map from abort path (Phil Sutter) [RHEL-35052] {CVE-2024-27011} - netfilter: nf_tables: reject new basechain after table flag update (Phil Sutter) [RHEL-37193] {CVE-2024-35900} - netfilter: nf_tables: flush pending destroy work before exit_net release (Phil Sutter) [RHEL-37197] {CVE-2024-35899} - netfilter: complete validation of user input (Phil Sutter) [RHEL-37210] - netfilter: validate user input for expected length (Phil Sutter) [RHEL-37210] {CVE-2024-35896} - netfilter: tproxy: bail out if IP has been disabled on the device (Phil Sutter) [RHEL-44363] {CVE-2024-36270} - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (Phil Sutter) [RHEL-44532] {CVE-2024-36286} - netfilter: nf_tables: do not compare internal table flags on updates (Phil Sutter) [RHEL-35114] {CVE-2024-27065} - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (Phil Sutter) [RHEL-35028] {CVE-2024-27019} - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (Phil Sutter) [RHEL-35024] {CVE-2024-27020} - netfilter: nf_tables: __nft_expr_type_get() selects specific family type (Phil Sutter) [RHEL-35024] - netfilter: conntrack: serialize hash resizes and cleanups (Phil Sutter) [RHEL-37703] {CVE-2021-47408} - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (Phil Sutter) [RHEL-34217] {CVE-2024-26925} - netfilter: nf_tables: release batch on table validation from abort path (Phil Sutter) [RHEL-34217] - ipvlan: add ipvlan_route_v6_outbound() helper (Davide Caratti) [RHEL-38319] {CVE-2023-52796} - [rt] build kernel-rt-4.18.0-553.12.1.rt7.353.el8_10 [RHEL-44553] - net: bridge: xmit: make sure we have at least eth header len bytes (cki-backport-bot) [RHEL-44291] {CVE-2024-38538} - drivers/amd/pm: fix a use-after-free in kv_parse_power_table (Michel Dänzer) [RHEL-26893] {CVE-2023-52469} - SUNRPC: Fix a suspicious RCU usage warning (Scott Mayhew) [RHEL-30503] {CVE-2023-52623} - ice: Fix some null pointer dereference issues in ice_ptp.c (Petr Oros) [RHEL-26901] {CVE-2023-52471} - xfs: fix internal error from AGFL exhaustion (Pavel Reichl) [RHEL-45581] - sched/psi: Fix use-after-free in ep_remove_wait_queue() (Phil Auld) [RHEL-38117] {CVE-2023-52707} - wait: add wake_up_pollfree() (Phil Auld) [RHEL-38117] - net/ipv6: avoid possible UAF in ip6_route_mpath_notify() (Hangbin Liu) [RHEL-33269] {CVE-2024-26852} - net: bridge: switchdev: Skip MDB replays of deferred events on offload (Ivan Vecera) [RHEL-33117] {CVE-2024-26837} - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (Pavel Reichl) [RHEL-31700] {CVE-2024-26772} - ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() (Pavel Reichl) [RHEL-31688] {CVE-2024-26773} - ext4: fix double-free of blocks due to wrong extents moved_len (Pavel Reichl) [RHEL-31612] {CVE-2024-26704} - vxlan: Pull inner IP header in vxlan_xmit_one(). (Guillaume Nault) [RHEL-31389] - geneve: Fix incorrect inner network header offset when innerprotoinherit is set (Guillaume Nault) [RHEL-31389] - vxlan: Pull inner IP header in vxlan_rcv(). (Guillaume Nault) [RHEL-31389] - geneve: fix header validation in geneve[6]_xmit_skb (Guillaume Nault) [RHEL-31389] - geneve: make sure to pull inner header in geneve_rx() (Guillaume Nault) [RHEL-31389] - net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb (Guillaume Nault) [RHEL-31389] - net: geneve: check skb is large enough for IPv4/IPv6 header (Guillaume Nault) [RHEL-31389] - net/smc: fix neighbour and rtable leak in smc_ib_find_route() (Tobias Huschle) [RHEL-39744] {CVE-2024-36945} - igb: Fix string truncation warnings in igb_set_fw_version (Corinna Vinschen) [RHEL-38452] {CVE-2024-36010} - bonding: stop the device in bond_setup_by_slave() (Hangbin Liu) [RHEL-38327] {CVE-2023-52784} - i40e: fix vf may be used uninitialized in this function warning (Kamal Heib) [RHEL-39702] {CVE-2024-36020} - powerpc/64: Fix the definition of the fixmap area (Mamatha Inamdar) [RHEL-27191] {CVE-2021-47018} - powerpc/mm/hash64: Add a variable to track the end of IO mapping (Mamatha Inamdar) [RHEL-27191] {CVE-2021-47018} - nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). (Xin Long) [RHEL-39770] {CVE-2024-36933} - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (Xin Long) [RHEL-39770] - net: core: reject skb_copy(_expand) for fraglist GSO skbs (Xin Long) [RHEL-39779] {CVE-2024-36929} - tcp: properly terminate timers for kernel sockets (Guillaume Nault) [RHEL-37171] {CVE-2024-35910} - net: relax socket state check at accept time. (Florian Westphal) [RHEL-39831] - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (Florian Westphal) [RHEL-39831] {CVE-2024-36905} - tcp: remove redundant check on tskb (Florian Westphal) [RHEL-39831] - drm/ast: Fix soft lockup (cki-backport-bot) [RHEL-37438] {CVE-2024-35952} - null_blk: Fix return value of nullb_device_power_store() (Ming Lei) [RHEL-39341] - null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues' (Ming Lei) [RHEL-39341] - null_blk: fix return value from null_add_dev() (Ming Lei) [RHEL-39341] - [rt] build kernel-rt-4.18.0-553.11.1.rt7.352.el8_10 [RHEL-44553] - x86/bugs: Reverse instruction order of CLEAR_CPU_BUFFERS (Waiman Long) [RHEL-42121] - Revert "x86/bugs: Use fixed addressing for VERW operand" (Waiman Long) [RHEL-42121] - KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests (Waiman Long) [RHEL-42121] - x86/rfds: Mitigate Register File Data Sampling (RFDS) (Waiman Long) [RHEL-42121] - Documentation/hw-vuln: Add documentation for RFDS (Waiman Long) [RHEL-42121] - x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set (Waiman Long) [RHEL-42121] - x86/bugs: Use fixed addressing for VERW operand (Waiman Long) [RHEL-42121] - KVM/VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH (Waiman Long) [RHEL-42121] - x86/bugs: Use ALTERNATIVE() instead of mds_user_clear static key (Waiman Long) [RHEL-42121] - x86/entry_32: Add VERW just before userspace transition (Waiman Long) [RHEL-42121] - x86/entry_64: Add VERW just before userspace transition (Waiman Long) [RHEL-42121] - x86/bugs: Add asm helpers for executing VERW (Waiman Long) [RHEL-42121] - x86/cpu: Fix Gracemont uarch (Waiman Long) [RHEL-42121] - Documentation/hw-vuln: Unify filename specification in index (Waiman Long) [RHEL-42121] - KVM: VMX: Access @flags as a 32-bit value in __vmx_vcpu_run() (Waiman Long) [RHEL-42121] - x86/asm: Add _ASM_RIP() macro for x86-64 (%rip) suffix (Waiman Long) [RHEL-42121] - x86/asm: Have the __ASM_FORM macros handle commas in arguments (Waiman Long) [RHEL-42121] - x86/asm: Allow to pass macros to __ASM_FORM() (Waiman Long) [RHEL-42121] - wifi: iwlwifi: mvm: guard against invalid STA ID on removal (Jose Ignacio Tornos Martinez) [RHEL-39801] {CVE-2024-36921} - ipv6: Fix potential uninit-value access in __ip6_make_skb() (Antoine Tenart) [RHEL-39784] - ipv4: Fix uninit-value access in __ip_make_skb() (Antoine Tenart) [RHEL-39784] {CVE-2024-36927} - perf mmap: Lazily initialize zstd streams to save memory when not using it (Michael Petlan) [RHEL-34876] - perf tools: Fix spelling mistake "commpressor" -> "compressor" (Michael Petlan) [RHEL-34876] - perf record: Introduce data transferred and compressed stats (Michael Petlan) [RHEL-34876] - perf record: Introduce compressor at mmap buffer object (Michael Petlan) [RHEL-34876] - perf record: Introduce bytes written stats (Michael Petlan) [RHEL-34876] - perf record: Introduce data file at mmap buffer object (Michael Petlan) [RHEL-34876] - perf record: Start threads in the beginning of trace streaming (Alexey Bayduraev) [RHEL-34876] - perf record: Stop threads in the end of trace streaming (Michael Petlan) [RHEL-34876] - perf record: Introduce thread local variable (Michael Petlan) [RHEL-34876] - perf record: Introduce function to propagate control commands (Michael Petlan) [RHEL-34876] - perf record: Introduce thread specific data array (Michael Petlan) [RHEL-34876] - tools lib: Introduce fdarray duplicate function (Michael Petlan) [RHEL-34876] - perf record: Introduce thread affinity and mmap masks (Michael Petlan) [RHEL-34876] - gfs2: Be more careful with the quota sync generation (Andreas Gruenbacher) [RHEL-40901] - gfs2: Get rid of some unnecessary quota locking (Andreas Gruenbacher) [RHEL-40901] - gfs2: Add some missing quota locking (Andreas Gruenbacher) [RHEL-40901] - gfs2: Fold qd_fish into gfs2_quota_sync (Andreas Gruenbacher) [RHEL-40901] - gfs2: quota need_sync cleanup (Andreas Gruenbacher) [RHEL-40901] - gfs2: Fix and clean up function do_qc (Andreas Gruenbacher) [RHEL-40901] - gfs2: Revert "Add quota_change type" (Andreas Gruenbacher) [RHEL-40901] - gfs2: Revert "ignore negated quota changes" (Andreas Gruenbacher) [RHEL-40901] - gfs2: qd_check_sync cleanups (Andreas Gruenbacher) [RHEL-40901] - gfs2: Check quota consistency on mount (Andreas Gruenbacher) [RHEL-40901] - gfs2: Minor gfs2_quota_init error path cleanup (Andreas Gruenbacher) [RHEL-40901] - gfs2: fix kernel BUG in gfs2_quota_cleanup (Edward Adam Davis) [RHEL-40901] - gfs2: Clean up quota.c:print_message (Andreas Gruenbacher) [RHEL-40901] - gfs2: Clean up gfs2_alloc_parms initializers (Andreas Gruenbacher) [RHEL-40901] - gfs2: Two quota=account mode fixes (Andreas Gruenbacher) [RHEL-40901] - gfs2: Remove useless assignment (Bob Peterson) [RHEL-40901] - gfs2: simplify slot_get (Bob Peterson) [RHEL-40901] - gfs2: Simplify qd2offset (Bob Peterson) [RHEL-40901] - gfs2: Remove quota allocation info from quota file (Bob Peterson) [RHEL-40901] - gfs2: use constant for array size (Bob Peterson) [RHEL-40901] - gfs2: Set qd_sync_gen in do_sync (Bob Peterson) [RHEL-40901] - gfs2: Remove useless err set (Bob Peterson) [RHEL-40901] - gfs2: Small gfs2_quota_lock cleanup (Bob Peterson) [RHEL-40901] - gfs2: move qdsb_put and reduce redundancy (Bob Peterson) [RHEL-40901] - gfs2: Don't try to sync non-changes (Bob Peterson) [RHEL-40901] - gfs2: Simplify function need_sync (Bob Peterson) [RHEL-40901] - gfs2: remove unneeded pg_oflow variable (Bob Peterson) [RHEL-40901] - gfs2: remove unneeded variable done (Bob Peterson) [RHEL-40901] - gfs2: pass sdp to gfs2_write_buf_to_page (Bob Peterson) [RHEL-40901] - gfs2: pass sdp in to gfs2_write_disk_quota (Bob Peterson) [RHEL-40901] - gfs2: Pass sdp to gfs2_adjust_quota (Bob Peterson) [RHEL-40901] - gfs2: remove dead code for quota writes (Bob Peterson) [RHEL-40901] - gfs2: Use qd_sbd more consequently (Bob Peterson) [RHEL-40901] - gfs2: replace 'found' with dedicated list iterator variable (Jakob Koschel) [RHEL-40901] - gfs2: Some whitespace cleanups (Andreas Gruenbacher) [RHEL-40901] - gfs2: Fix gfs2_qa_get imbalance in gfs2_quota_hold (Bob Peterson) [RHEL-40901] - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg (Guillaume Nault) [RHEL-43961] {CVE-2024-38596} - af_unix: Fix data-races around sk->sk_shutdown. (Guillaume Nault) [RHEL-43961] {CVE-2024-38596} - af_unix: Fix data races around sk->sk_shutdown. (Guillaume Nault) [RHEL-43961] {CVE-2024-38596} - perf/core: Fix event sibling list locking (Daniel Vacek) [RHEL-31798] - media: bttv: fix use after free error due to btv->timeout timer (Kate Hsuan) [RHEL-38256] {CVE-2023-52847} - arp: Prevent overflow in arp_req_get(). (Antoine Tenart) [RHEL-31706] {CVE-2024-26733} - Bluetooth: btusb: Add a new PID/VID 0489/e0c8 for MT7921 (David Marlin) [RHEL-10263] - mm: swap: fix race between free_swap_and_cache() and swapoff() (Waiman Long) [RHEL-34971] {CVE-2024-26960} - swap: comments get_swap_device() with usage rule (Waiman Long) [RHEL-34971] {CVE-2024-26960} - mm/swapfile.c: __swap_entry_free() always free 1 entry (Waiman Long) [RHEL-34971] {CVE-2024-26960} - mm/swapfile.c: call free_swap_slot() in __swap_entry_free() (Waiman Long) [RHEL-34971] {CVE-2024-26960} - mm/swapfile.c: use __try_to_reclaim_swap() in free_swap_and_cache() (Waiman Long) [RHEL-34971] {CVE-2024-26960} - net: amd-xgbe: Fix skb data length underflow (Ken Cox) [RHEL-43788] {CVE-2022-48743} - ovl: fix warning in ovl_create_real() (cki-backport-bot) [RHEL-43652] {CVE-2021-47579} - net/sched: initialize noop_qdisc owner (Davide Caratti) [RHEL-35056] - net/sched: Fix mirred deadlock on device recursion (Davide Caratti) [RHEL-35056] {CVE-2024-27010} - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (Pavel Reichl) [RHEL-45029] {CVE-2024-39276} - ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() (Ken Cox) [RHEL-38713] {CVE-2021-47548} - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound (Hangbin Liu) [RHEL-44396] {CVE-2024-33621} - mlxsw: spectrum_acl_tcam: Fix stack corruption (Ivan Vecera) [RHEL-26462] {CVE-2024-26586} - inet: inet_defrag: prevent sk release while still in use (Antoine Tenart) [RHEL-33398] {CVE-2024-26921} - skb_expand_head() adjust skb->truesize incorrectly (Antoine Tenart) [RHEL-33398] - nvmet: fix ns enable/disable possible hang (Ming Lei) [RHEL-43547] - [rt] build kernel-rt-4.18.0-553.10.1.rt7.351.el8_10 [RHEL-44553] - SUNRPC: Fix RPC client cleaned up the freed pipefs dentries (Scott Mayhew) [RHEL-38264] {CVE-2023-52803} - scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() (Ewan D. Milne) [RHEL-39717] {CVE-2024-36025} - tcp: add sanity checks to rx zerocopy (Guillaume Nault) [RHEL-29494] {CVE-2024-26640} - SUNRPC: fix some memleaks in gssx_dec_option_array (Scott Mayhew) [RHEL-35209] {CVE-2024-27388} - wifi: nl80211: don't free NULL coalescing rule (Jose Ignacio Tornos Martinez) [RHEL-39752] {CVE-2024-36941} - nfs: fix UAF in direct writes (Scott Mayhew) [RHEL-34975] {CVE-2024-26958} - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 (Scott Mayhew) [RHEL-33228] {CVE-2024-26870} - drm/amd/pm: Fix error of MACO flag setting code (Michel Dänzer) [RHEL-15928] - scsi: aacraid: fix io hangs and improve performance (John Meneghini) [RHEL-23913] - block: prevent division by zero in blk_rq_stat_sum() (Ming Lei) [RHEL-37279] {CVE-2024-35925} - block: fix overflow in blk_ioctl_discard() (Ming Lei) [RHEL-39811] {CVE-2024-36917} - virtio-blk: fix implicit overflow on virtio_max_dma_size (Ming Lei) [RHEL-38131] {CVE-2023-52762} - nbd: null check for nla_nest_start (Ming Lei) [RHEL-35176] {CVE-2024-27025} - isdn: mISDN: netjet: Fix crash in nj_probe: (Ken Cox) [RHEL-38444] {CVE-2021-47284} - isdn: mISDN: Fix sleeping function called from invalid context (Ken Cox) [RHEL-38400] {CVE-2021-47468} - net/smc: avoid data corruption caused by decline (Tobias Huschle) [RHEL-38234] {CVE-2023-52775} - ubi: Check for too small LEB size in VTBL code (David Arcari) [RHEL-25092] {CVE-2024-25739} - i2c: core: Fix atomic xfer check for non-preempt config (Steve Best) [RHEL-38313] {CVE-2023-52791} - i2c: core: Run atomic i2c xfer when !preemptible (Steve Best) [RHEL-38313] {CVE-2023-52791} - firewire: ohci: mask bus reset interrupts between ISR and bottom half (Steve Best) [RHEL-39902] {CVE-2024-36950} - ipv6: init the accept_queue's spinlocks in inet6_create (Guillaume Nault) [RHEL-28899] {CVE-2024-26614} - tcp: make sure init the accept_queue's spinlocks once (Guillaume Nault) [RHEL-28899] {CVE-2024-26614} - tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (Steve Best) [RHEL-39352] {CVE-2024-36016} - mlxsw: spectrum_acl_tcam: Fix incorrect list API usage (Ivan Vecera) [RHEL-37484] {CVE-2024-36006} - pwm: Fix double shift bug (Steve Best) [RHEL-38278] {CVE-2023-52756} - mmc: sdio: fix possible resource leaks in some error paths (Steve Best) [RHEL-38149] {CVE-2023-52730} - of: unittest: Fix compile in the non-dynamic case (Steve Best) [RHEL-37070] {CVE-2023-52679} - of: unittest: Fix of_count_phandle_with_args() expected value message (Steve Best) [RHEL-37070] {CVE-2023-52679} - of: Fix double free in of_parse_phandle_with_args_map (Steve Best) [RHEL-37070] {CVE-2023-52679} - pinctrl: core: delete incorrect free in pinctrl_enable() (Steve Best) [RHEL-39756] {CVE-2024-36940} - pinctrl: core: fix possible memory leak in pinctrl_enable() (Steve Best) [RHEL-39756] {CVE-2024-36940} - media: gspca: cpia1: shift-out-of-bounds in set_flicker (Desnes Nunes) [RHEL-38331] {CVE-2023-52764} - tipc: fix a possible memleak in tipc_buf_append (Xin Long) [RHEL-39881] {CVE-2024-36954} - cifs: fix mid leak during reconnection after timeout threshold (Paulo Alcantara) [RHEL-36222] - cifs: Fix use-after-free in rdata->read_into_pages() (Paulo Alcantara) [RHEL-36222] - cifs: Fix pages leak when writedata alloc failed in cifs_write_from_iter() (Paulo Alcantara) [RHEL-36222] - cifs: Fix pages array leak when writedata alloc failed in cifs_writedata_alloc() (Paulo Alcantara) [RHEL-36222] - cifs: destage dirty pages before re-reading them for cache=none (Paulo Alcantara) [RHEL-36222] - cifs: destage any unwritten data to the server before calling copychunk_write (Paulo Alcantara) [RHEL-36222] - Adjust cifssb maximum read size (Paulo Alcantara) [RHEL-36222] - cifs: make locking consistent around the server session status (Paulo Alcantara) [RHEL-36222] - cifs: fix credit accounting for extra channel (Paulo Alcantara) [RHEL-36222] - smb3: prevent races updating CurrentMid (Paulo Alcantara) [RHEL-36222] - cifs: fix missing spinlock around update to ses->status (Paulo Alcantara) [RHEL-36222] - cifs: use echo_interval even when connection not ready. (Paulo Alcantara) [RHEL-36222] - cifs: detect dead connections only when echoes are enabled. (Paulo Alcantara) [RHEL-36222] - cifs: Fix preauth hash corruption (Paulo Alcantara) [RHEL-36222] - cifs: do not send close in compound create+close requests (Paulo Alcantara) [RHEL-36222] - cifs: ask for more credit on async read/write code paths (Paulo Alcantara) [RHEL-36222] - cifs: use discard iterator to discard unneeded network data more efficiently (Paulo Alcantara) [RHEL-36222] - cifs: Fix in error types returned for out-of-credit situations. (Paulo Alcantara) [RHEL-36222] - smb3: fix crediting for compounding when only one request in flight (Paulo Alcantara) [RHEL-36222] - cifs: New optype for session operations. (Paulo Alcantara) [RHEL-36222] - mm/gup: do not return 0 from pin_user_pages_fast() for bad args (Paulo Alcantara) [RHEL-36222] - wifi: brcmfmac: pcie: handle randbuf allocation failure (Jose Ignacio Tornos Martinez) [RHEL-44124] {CVE-2024-38575} - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). (Guillaume Nault) [RHEL-39835] {CVE-2024-36904} - wifi: mac80211: don't return unset power in ieee80211_get_tx_power() (Jose Ignacio Tornos Martinez) [RHEL-38159] {CVE-2023-52832} - wifi: ath11k: fix gtk offload status event locking (Jose Ignacio Tornos Martinez) [RHEL-38155] {CVE-2023-52777} - net: ieee802154: fix null deref in parse dev addr (Steve Best) [RHEL-38012] {CVE-2021-47257} - mm/hugetlb: fix missing hugetlb_lock for resv uncharge (Rafael Aquini) [RHEL-37465] {CVE-2024-36000} - x86/xen: Add some null pointer checking to smp.c (Vitaly Kuznetsov) [RHEL-33258] {CVE-2024-26908} - x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() (Vitaly Kuznetsov) [RHEL-33258] {CVE-2024-26908} - wifi: cfg80211: check A-MSDU format more carefully (Jose Ignacio Tornos Martinez) [RHEL-37343] {CVE-2024-35937} - wifi: rtw89: fix null pointer access when abort scan (Jose Ignacio Tornos Martinez) [RHEL-37355] {CVE-2024-35946} - atl1c: Work around the DMA RX overflow issue (Ken Cox) [RHEL-38287] {CVE-2023-52834} - wifi: ath11k: decrease MHI channel buffer length to 8KB (Jose Ignacio Tornos Martinez) [RHEL-37339] {CVE-2024-35938} - wifi: iwlwifi: mvm: rfi: fix potential response leaks (Jose Ignacio Tornos Martinez) [RHEL-37163] {CVE-2024-35912} - USB: core: Fix access violation during port device removal (Desnes Nunes) [RHEL-39853] {CVE-2024-36896} - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() (Ewan D. Milne) [RHEL-37123] {CVE-2024-35930} - netfilter: nf_tables: honor table dormant flag from netdev release event path (Phil Sutter) [RHEL-37450] {CVE-2024-36005} - wifi: iwlwifi: mvm: don't set the MFP flag for the GTK (Jose Ignacio Tornos Martinez) [RHEL-36898] {CVE-2024-27434} - wifi: iwlwifi: mvm: Fix key flags for IGTK on AP interface (Jose Ignacio Tornos Martinez) [RHEL-36898] {CVE-2024-27434} - misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspend/resume (Steve Best) [RHEL-36932] {CVE-2024-35824} - [rt] build kernel-rt-4.18.0-553.9.1.rt7.350.el8_10 [RHEL-44553] - x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (Steve Best) [RHEL-37262] {CVE-2024-35876} - net/sched: flower: Fix chain template offload (Xin Long) [RHEL-31313] {CVE-2024-26669} - SUNRPC: fix a memleak in gss_import_v2_context (Scott Mayhew) [RHEL-35195] {CVE-2023-52653} - efivarfs: force RO when remounting if SetVariable is not supported (Pavel Reichl) [RHEL-26564] {CVE-2023-52463} - dmaengine: idxd: add a write() method for applications to submit work (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823} - dmaengine: idxd: add a new security check to deal with a hardware erratum (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823} - VFIO: Add the SPR_DSA and SPR_IAX devices to the denylist (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823} - quota: Fix potential NULL pointer dereference (Pavel Reichl) [RHEL-33219] {CVE-2024-26878} - locking/lockdep: Fix overflow in presentation of average lock-time (Čestmír Kalina) [RHEL-17678] - blk-cgroup: Properly propagate the iostat update up the hierarchy (Ming Lei) [RHEL-40939] - proc: Use new_inode not new_inode_pseudo (Ian Kent) [RHEL-40167] - stmmac: Clear variable when destroying workqueue (Izabela Bakollari) [RHEL-31822] {CVE-2024-26802} - powerpc/pseries/memhp: Fix access beyond end of drmem array (Mamatha Inamdar) [RHEL-26495] {CVE-2023-52451} - platform/x86: wmi: Fix opening of char device (David Arcari) [RHEL-38258] {CVE-2023-52864} - Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" (Kamal Heib) [RHEL-36908] {CVE-2023-52658} - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed (Cathy Avery) [RHEL-39074] - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove (Cathy Avery) [RHEL-39074] - hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes (Cathy Avery) [RHEL-39074] - hv_netvsc: remove duplicated including of slab.h (Cathy Avery) [RHEL-39074] - hv_netvsc: rndis_filter needs to select NLS (Cathy Avery) [RHEL-39074] - hv_netvsc: Mark VF as slave before exposing it to user-mode (Cathy Avery) [RHEL-39074] - hv_netvsc: Fix race of register_netdevice_notifier and VF register (Cathy Avery) [RHEL-39074] - hv_netvsc: fix race of netvsc and VF register_netdevice (Cathy Avery) [RHEL-39074] - hv_netvsc: fix netvsc_send_completion to avoid multiple message length checks (Cathy Avery) [RHEL-39074] - hv_netvsc: Allocate rx indirection table size dynamically (Cathy Avery) [RHEL-39074] - net: hv_netvsc: Fix a warning triggered by memcpy in rndis_filter (Cathy Avery) [RHEL-39074] - gfs2: Fix lru_count accounting (Andreas Gruenbacher) [RHEL-32941] - gfs2: Fix "Make glock lru list scanning safer" (Andreas Gruenbacher) [RHEL-32941] - gfs2: Fix "ignore unlock failures after withdraw" (Andreas Gruenbacher) [RHEL-32941] - gfs2: Don't set GLF_LOCK in gfs2_dispose_glock_lru (Andreas Gruenbacher) [RHEL-32941] - gfs2: Don't forget to complete delayed withdraw (Andreas Gruenbacher) [RHEL-32941] - gfs2: Delay withdraw from atomic context (Andreas Gruenbacher) [RHEL-32941] - gfs2: trivial clean up of gfs2_ail_error (Andreas Gruenbacher) [RHEL-32941] - ext4: fix corruption during on-line resize (Carlos Maiolino) [RHEL-36974] {CVE-2024-35807} - ext4: correct offset of gdb backup in non meta_bg group to update_backups (Carlos Maiolino) [RHEL-36974] - ext4: avoid online resizing failures due to oversized flex bg (Carlos Maiolino) [RHEL-30507] {CVE-2023-52622} - ext4: use time_is_before_jiffies() instead of open coding it (Carlos Maiolino) [RHEL-30507] - ext4: unify the type of flexbg_size to unsigned int (Carlos Maiolino) [RHEL-30507] - ext4: remove unnecessary check from alloc_flex_gd() (Carlos Maiolino) [RHEL-30507] - tracing: Do no increment trace_clock_global() by one (Jerome Marchand) [RHEL-27107] {CVE-2021-46939} - tracing: Restructure trace_clock_global() to never block (Jerome Marchand) [RHEL-27107] {CVE-2021-46939} - net/sched: act_skbmod: prevent kernel-infoleak (Xin Long) [RHEL-37220] {CVE-2024-35893} - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (Xin Long) [RHEL-38307] {CVE-2023-52845} - redhat: remove the merge subtrees script (Derek Barbosa) - redhat: rhdocs: delete .get_maintainer.conf (Derek Barbosa) - redhat: rhdocs: Remove the rhdocs directory (Derek Barbosa) - dyndbg: fix old BUG_ON in >control parser (Waiman Long) [RHEL-37111] {CVE-2024-35947} - dyndbg: let query-modname override actual module name (Waiman Long) [RHEL-37111] - dyndbg: make dyndbg a known cli param (Waiman Long) [RHEL-37111] - lan78xx: Fix exception on link speed change (Jamie Bainbridge) [RHEL-33437] - net: usb: lan78xx: don't modify phy_device state concurrently (Jamie Bainbridge) [RHEL-33437] - efi: runtime: Fix potential overflow of soft-reserved region size (Lenny Szubowicz) [RHEL-33096] {CVE-2024-26843} - perf/arm-cmn: Fail DTC counter allocation correctly (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Rework DTC counters (again) (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Fix DTC domain detection (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Revamp model detection (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Fix port detection for CMN-700 (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Move overlapping wp_combine field (Michael Petlan) [RHEL-23841] - Partially revert "perf/arm-cmn: Optimise DTC counter accesses" (Michael Petlan) [RHEL-23841] - drivers/perf: Compile with gnu99 standard (Michael Petlan) [RHEL-23841] - x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (Steve Best) [RHEL-36994] {CVE-2024-35801} - watchdog: softdog: Add options 'soft_reboot_cmd' and 'soft_active_on_boot' (Waiman Long) [RHEL-19723] - tipc: fix UAF in error path (Xin Long) [RHEL-34278] {CVE-2024-36886} - [rt] build kernel-rt-4.18.0-553.8.1.rt7.349.el8_10 [RHEL-40882] - udf: Fix NULL pointer dereference in udf_symlink function (Pavel Reichl) [RHEL-37769] {CVE-2021-47353} - net: ti: fix UAF in tlan_remove_one (Jose Ignacio Tornos Martinez) [RHEL-38940] {CVE-2021-47310} - ARM: footbridge: fix PCI interrupt mapping (Myron Stowe) [RHEL-26971] {CVE-2021-46909} - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (Kamal Heib) [RHEL-37454] {CVE-2024-36004} - net/mlx5e: Fix mlx5e_priv_init() cleanup flow (Kamal Heib) [RHEL-37424] {CVE-2024-35959} - net/mlx5: Properly link new fs rules into the tree (Kamal Heib) [RHEL-37420] {CVE-2024-35960} - net/mlx5e: fix a potential double-free in fs_any_create_groups (Kamal Heib) [RHEL-37091] {CVE-2023-52667} - net: ena: Fix incorrect descriptor free behavior (Kamal Heib) [RHEL-37428] {CVE-2024-35958} - mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - mISDN: fix possible use-after-free in HFC_cleanup() (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - implement dh fallback for primes > 4K (Vladis Dronov) [RHEL-35106] - crypto: qat - avoid division by zero (Vladis Dronov) [RHEL-35106] - crypto: qat - resolve race condition during AER recovery (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - use kcalloc_node() instead of kzalloc_node() (Vladis Dronov) [RHEL-35106] - [rt] Enable CONFIG_DRM_MGAG200_DISABLE_WRITECOMBINE (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Add an option to disable Write-Combine (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Fix caching setup for remapped video memory (Jocelyn Falempe) [RHEL-36172] - Revert "drm/mgag200: Add a workaround for low-latency" (Jocelyn Falempe) [RHEL-36172] - mptcp: fix data re-injection from stale subflow (Davide Caratti) [RHEL-33133] {CVE-2024-26826} - ipv6: sr: fix incorrect unregister order (Hangbin Liu) [RHEL-31730] - ipv6: sr: fix possible use-after-free and null-ptr-deref (Hangbin Liu) [RHEL-31730] {CVE-2024-26735} - net/bnx2x: Prevent access to a freed page in page_pool (Michal Schmidt) [RHEL-14195 RHEL-33243] {CVE-2024-26859} - bnx2x: new flag for track HW resource allocation (Michal Schmidt) [RHEL-14195 RHEL-33243] - bnx2x: fix page fault following EEH recovery (Michal Schmidt) [RHEL-14195 RHEL-33243] - x86: KVM: SVM: always update the x2avic msr interception (Maxim Levitsky) [RHEL-15495] {CVE-2023-5090} - EDAC/thunderx: Fix possible out-of-bounds string access (Aristeu Rozanski) [RHEL-26573] {CVE-2023-52464} - [rt] build kernel-rt-4.18.0-553.7.1.rt7.348.el8_10 [RHEL-34640] - net: qcom/emac: fix UAF in emac_remove (Ken Cox) [RHEL-37834] {CVE-2021-47311} - perf/core: Bail out early if the request AUX area is out of bound (Michael Petlan) [RHEL-38268] {CVE-2023-52835} - crypto: pcrypt - Fix hungtask for PADATA_RESET (Herbert Xu) [RHEL-38171] {CVE-2023-52813} - drm/amdgpu: fix use-after-free bug (Jocelyn Falempe) [RHEL-31240] {CVE-2024-26656} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash (Ivan Vecera) [RHEL-37008] {CVE-2024-35854} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update (Ivan Vecera) [RHEL-37004] {CVE-2024-35855} - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (Ivan Vecera) [RHEL-37012] {CVE-2024-35853} - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work (Ivan Vecera) [RHEL-37016] {CVE-2024-35852} - mlxsw: spectrum_acl_tcam: Fix warning during rehash (Ivan Vecera) [RHEL-37480] {CVE-2024-36007} - can: peak_pci: peak_pci_remove(): fix UAF (Jose Ignacio Tornos Martinez) [RHEL-38419] {CVE-2021-47456} - usbnet: fix error return code in usbnet_probe() (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - usbnet: sanity check for maxpacket (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - net/mlx5e: fix a double-free in arfs_create_groups (Kamal Heib) [RHEL-36920] {CVE-2024-35835} - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds (Jose Ignacio Tornos Martinez) [RHEL-38220] {CVE-2023-52878} - net: cdc_eem: fix tx fixup skb leak (Jose Ignacio Tornos Martinez) [RHEL-38080] {CVE-2021-47236} - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Jose Ignacio Tornos Martinez) [RHEL-38113] {CVE-2023-52703} - usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() (Desnes Nunes) [RHEL-38248] {CVE-2023-52877} - usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (Desnes Nunes) [RHEL-38240] {CVE-2023-52781} - gro: fix ownership transfer (Xin Long) [RHEL-37226] {CVE-2024-35890} - tipc: fix kernel warning when sending SYN message (Xin Long) [RHEL-38109] {CVE-2023-52700} - erspan: make sure erspan_base_hdr is present in skb->head (Xin Long) [RHEL-37230] {CVE-2024-35888} - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() (Bryan Gurney) [RHEL-17366] - scsi: mpi3mr: Sanitise num_phys (Bryan Gurney) [RHEL-17366] - netfilter: nf_tables: use timestamp to check for set element timeout (Phil Sutter) [RHEL-38023] {CVE-2024-27397} - net/ipv6: SKB symmetric hash should incorporate transport ports (Sabrina Dubroca) [RHEL-32061] - crypto: s390/aes - Fix buffer overread in CTR mode (Herbert Xu) [RHEL-37089] {CVE-2023-52669} - net: Save and restore msg_namelen in sock_sendmsg (Jamie Bainbridge) [RHEL-35893] - net: prevent address rewrite in kernel_bind() (Jamie Bainbridge) [RHEL-35893] - net: prevent rewrite of msg_name in sock_sendmsg() (Jamie Bainbridge) [RHEL-35893] - net: replace calls to sock->ops->connect() with kernel_connect() (Jamie Bainbridge) [RHEL-35893] - net: Avoid address overwrite in kernel_connect (Jamie Bainbridge) [RHEL-35893] - wifi: iwlwifi: dbg-tlv: ensure NUL termination (Jose Ignacio Tornos Martinez) [RHEL-37026] {CVE-2024-35845} - wifi: mac80211: fix potential sta-link leak (Jose Ignacio Tornos Martinez) [RHEL-36916] {CVE-2024-35838} - wifi: nl80211: reject iftype change with mesh ID change (Jose Ignacio Tornos Martinez) [RHEL-36884] {CVE-2024-27410} - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (Jose Ignacio Tornos Martinez) [RHEL-36807] {CVE-2024-35789} - Bluetooth: Avoid potential use-after-free in hci_error_reset (David Marlin) [RHEL-31826] {CVE-2024-26801} - tls: disable async encrypt/decrypt (Sabrina Dubroca) [RHEL-26362 RHEL-26409 RHEL-26420] {CVE-2024-26585 CVE-2024-26583 CVE-2024-26584} - Squashfs: check the inode number is not the invalid value of zero (Phillip Lougher) [RHEL-35096] {CVE-2024-26982} - ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/msg.c: update and document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/sem.c: document and update memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: update/document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: remove duplicated code (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (Kamal Heib) [RHEL-30582] {CVE-2023-52626} - Revert "ACPI: bus: Rework system-level device notification handling" (Prarit Bhargava) [RHEL-21486] - hwrng: core - Fix page fault dead lock on mmap-ed hwrng (Prarit Bhargava) [RHEL-29485] {CVE-2023-52615} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - powerpc/pseries: pci - logic bug (Mamatha Inamdar) [RHEL-240146] - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228} - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899] {CVE-2026-90036} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680] {CVE-2026-72262} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641} - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781] {CVE-2026-74583} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916] {CVE-2026-68377} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271288] {CVE-2026-89631} - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280060] {CVE-2026-98320} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271853] {CVE-2026-93817} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191034] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191034] {CVE-2026-53196} - gfs2: a minor finish_xmote cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor run_queue fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: only apply DLM_LKF_VALBLK if sb_lvbptr is not NULL (Alexander Aring) [RHEL-129363] - gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Use wait_event_freezable_timeout() for freezable kthread (Andreas Gruenbacher) [RHEL-129363] - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-129363] - gfs2: low-memory forced flush fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: add missing withdraw locking (Andreas Gruenbacher) [RHEL-129363] - gfs2: Disable GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename "gfs_recovery" workqueue to "gfs2_recovery" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-129363] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-129363] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify do_promote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-129363] - gfs2: introduce new gfs2_glock_assert_withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify refcounting in do_xmote (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Make recovery error more readable (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark the remaining process-independent glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark flock glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of newlines in log messages (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-129363] - gfs2: Sanitize kthread stopping (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix logd wakeup on I/O error (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_quotad (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_logd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove duplicate check in do_xmote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove space before newline (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix LM_FLAG_TRY* logic in add_to_queue (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove DLM_LKF_ALTCW / DLM_LKF_ALTPR code (Andreas Gruenbacher) [RHEL-129363] - gfs2: Further sanitize lock_dlm.c (Andreas Gruenbacher) [RHEL-129363] - gfs2: sanitize the gdlm_ast -> finish_xmote interface (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify DLM_LKF_QUECVT use (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-129363] - gfs2: Lift withdraw check out of gfs2_ail1_empty (Andreas Gruenbacher) [RHEL-129363] - gfs2: don't withdraw if init_threads() got interrupted (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-129363] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix slab-use-after-free in gfs2_qd_dealloc (Andreas Gruenbacher) [RHEL-129363] {CVE-2023-52760} - gfs2: Fix asynchronous thread destruction (Andreas Gruenbacher) [RHEL-129363] - gfs2: Stop using gfs2_make_fs_ro for withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-129363] - gfs2: Turn gfs2_withdraw into a void function (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark withdraws as unlikely (Andreas Gruenbacher) [RHEL-129363] - gfs2: ignore rindex_update failure in dinode_dealloc (Andreas Gruenbacher) [RHEL-129363] - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270732] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256684] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256684] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256684] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271657] {CVE-2026-93288} - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254282] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-263292] {CVE-2026-89479} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254357] {CVE-2026-74588} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222954] {CVE-2026-52935} - powerpc/pseries: pci - logic bug (Mamatha Inamdar) [RHEL-240146] - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228} - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899] {CVE-2026-90036} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680] {CVE-2026-72262} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641} - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781] {CVE-2026-74583} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916] {CVE-2026-68377} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270905] {CVE-2026-89777} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263644] {CVE-2026-68202} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254200] {CVE-2026-80590} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233134] {CVE-2026-64572} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225459] {CVE-2026-64114} - xfs: bounds-check buffer log item's dirty bitmap (CKI Backport Bot) [RHEL-253365] {CVE-2026-80536} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234242] {CVE-2026-64266} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271288] {CVE-2026-89631} - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280060] {CVE-2026-98320} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271853] {CVE-2026-93817} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191034] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191034] {CVE-2026-53196} - gfs2: a minor finish_xmote cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor run_queue fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: only apply DLM_LKF_VALBLK if sb_lvbptr is not NULL (Alexander Aring) [RHEL-129363] - gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Use wait_event_freezable_timeout() for freezable kthread (Andreas Gruenbacher) [RHEL-129363] - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-129363] - gfs2: low-memory forced flush fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: add missing withdraw locking (Andreas Gruenbacher) [RHEL-129363] - gfs2: Disable GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename "gfs_recovery" workqueue to "gfs2_recovery" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-129363] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-129363] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify do_promote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-129363] - gfs2: introduce new gfs2_glock_assert_withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify refcounting in do_xmote (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Make recovery error more readable (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark the remaining process-independent glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark flock glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of newlines in log messages (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-129363] - gfs2: Sanitize kthread stopping (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix logd wakeup on I/O error (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_quotad (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_logd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove duplicate check in do_xmote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove space before newline (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix LM_FLAG_TRY* logic in add_to_queue (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove DLM_LKF_ALTCW / DLM_LKF_ALTPR code (Andreas Gruenbacher) [RHEL-129363] - gfs2: Further sanitize lock_dlm.c (Andreas Gruenbacher) [RHEL-129363] - gfs2: sanitize the gdlm_ast -> finish_xmote interface (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify DLM_LKF_QUECVT use (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-129363] - gfs2: Lift withdraw check out of gfs2_ail1_empty (Andreas Gruenbacher) [RHEL-129363] - gfs2: don't withdraw if init_threads() got interrupted (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-129363] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix slab-use-after-free in gfs2_qd_dealloc (Andreas Gruenbacher) [RHEL-129363] {CVE-2023-52760} - gfs2: Fix asynchronous thread destruction (Andreas Gruenbacher) [RHEL-129363] - gfs2: Stop using gfs2_make_fs_ro for withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-129363] - gfs2: Turn gfs2_withdraw into a void function (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark withdraws as unlikely (Andreas Gruenbacher) [RHEL-129363] - gfs2: ignore rindex_update failure in dinode_dealloc (Andreas Gruenbacher) [RHEL-129363] - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270732] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256684] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256684] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256684] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271657] {CVE-2026-93288} - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254282] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-263292] {CVE-2026-89479} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254357] {CVE-2026-74588} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222954] {CVE-2026-52935} - powerpc/pseries: pci - logic bug (Mamatha Inamdar) [RHEL-240146] - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228} - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899] {CVE-2026-90036} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680] {CVE-2026-72262} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641} - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781] {CVE-2026-74583} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916] {CVE-2026-68377} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - [rt] build kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 [RHEL-53529] - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071} - [rt] build kernel-rt-4.18.0-553.21.1.rt7.362.el8_10 [RHEL-53529] - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874] - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558} - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441} - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904} - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322} - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246} - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008} - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228} - [rt] build kernel-rt-4.18.0-553.20.1.rt7.361.el8_10 [RHEL-53529] - KVM: arm64: Disassociate vcpus from redistributor region on teardown (Shaoqin Huang) [RHEL-48417] {CVE-2024-40989} - devres: Fix memory leakage caused by driver API devm_free_percpu() (CKI Backport Bot) [RHEL-55597] {CVE-2024-43871} - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (Izabela Bakollari) [RHEL-26680] {CVE-2024-26600} - nvmet-fc: avoid deadlock on delete association path (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - nvmet-fc: release reference on target port (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - ACPI: LPIT: Avoid u32 multiplication overflow (Mark Langsdorf) [RHEL-37062] {CVE-2023-52683} - sched/deadline: Fix task_struct reference leak (Phil Auld) [RHEL-50904] {CVE-2024-41023} - nfsd: fix crash on LOCKT on reexported NFSv3 (Benjamin Coddington) [RHEL-31515] - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path (CKI Backport Bot) [RHEL-26570] {CVE-2024-26595} - mlxsw: spectrum_acl_tcam: Move devlink param to TCAM code (Ivan Vecera) [RHEL-26570] {CVE-2024-26595} - ACPI: extlog: fix NULL pointer dereference check (Mark Langsdorf) [RHEL-29110] {CVE-2023-52605} - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() (Mark Langsdorf) [RHEL-33198] {CVE-2024-26894} - mm: prevent derefencing NULL ptr in pfn_section_valid() (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - mm, kmsan: fix infinite recursion due to RCU critical section (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - cipso: make cipso_v4_skbuff_delattr() fully remove the CIPSO options (Ondrej Mosnacek) [RHEL-30904] - cipso: fix total option length computation (Ondrej Mosnacek) [RHEL-30904] - ext4: do not create EA inode under buffer lock (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: check the return value of ext4_xattr_inode_dec_ref() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (Carlos Maiolino) [RHEL-48507] {CVE-2024-40998} - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - [rt] build kernel-rt-4.18.0-553.19.1.rt7.360.el8_10 [RHEL-53529] - drm/i915/vma: Fix UAF on destroy against retire race (Mika Penttilä) [RHEL-35222] {CVE-2024-26939} - RHEL-48620 (Kenneth Yin) [RHEL-48620] - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (CKI Backport Bot) [RHEL-42721] {CVE-2024-26855} - net: usb: asix: do not force pause frames support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix "can't send until first packet is send" issue (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix modprobe "sysfs: cannot create duplicate filename" (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: add proper error handling of usb read errors (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix wrong return value in asix_check_host_enable() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix uninit-value in asix_mdio_read() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: fix boolconv.cocci warnings (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: do not call phy_disconnect() for ax88178 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: move embedded PHY detection as early as possible (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix uninit value bugs (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add missing stop (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: suspend PHY on driver probe (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: manage PHY PM from MAC (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: add error handling for asix_mdio_* functions (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add phylib support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: refactor asix_read_phy_addr() and handle errors on return (Ken Cox) [RHEL-28108] {CVE-2021-47101} - SUNRPC: always free ctxt when freeing deferred request (Jay Shin) [RHEL-40936] - SUNRPC: double free xprt_ctxt while still in use (Jay Shin) [RHEL-40936] - SUNRPC: Remove svc_rqst::rq_xprt_hlen (Jay Shin) [RHEL-40936] - SUNRPC: Remove dead code in svc_tcp_release_rqst() (Jay Shin) [RHEL-40936] - x86/bugs: Extend VMware Retbleed workaround to Nehalem & earlier CPUs (Waiman Long) [RHEL-48646] - wifi: iwlwifi: read txq->read_ptr under lock (Jose Ignacio Tornos Martinez) [RHEL-39797] {CVE-2024-36922} - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (John Meneghini) [RHEL-39908] {CVE-2024-36919} - nbd: always initialize struct msghdr completely (Ming Lei) [RHEL-29498] {CVE-2024-26638} - block: don't call rq_qos_ops->done_bio if the bio isn't tracked (Ming Lei) [RHEL-42151] {CVE-2021-47412} - nvmet: fix a possible leak when destroy a ctrl during qp establishment (Maurizio Lombardi) [RHEL-52013] {CVE-2024-42152} - ipv6: prevent NULL dereference in ip6_output() (Sabrina Dubroca) [RHEL-39912] {CVE-2024-36901} - ppp: reject claimed-as-LCP but actually malformed packets (Guillaume Nault) [RHEL-51052] {CVE-2024-41044} - leds: trigger: Unregister sysfs attributes before calling deactivate() (CKI Backport Bot) [RHEL-54834] {CVE-2024-43830} - crypto: bcm - Fix pointer arithmetic (cki-backport-bot) [RHEL-44108] {CVE-2024-38579} - scsi: qedf: Ensure the copied buf is NUL terminated (John Meneghini) [RHEL-44195] {CVE-2024-38559} - x86/bhi: Avoid warning in #DB handler due to BHI mitigation (Waiman Long) [RHEL-53657] {CVE-2024-42240} - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (CKI Backport Bot) [RHEL-47529] {CVE-2024-40901} - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (CKI Backport Bot) [RHEL-39843] {CVE-2024-36902} - net: usb: ax88179_178a: improve link status logs (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: improve reset check (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: fix link status when link is set to down/up (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: avoid writing the mac address before first reading (Jose Ignacio Tornos Martinez) [RHEL-45167] - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - media: cec: cec-api: add locking in cec_release() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid confusing "transmit timed out" message (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid recursive cec_claim_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: remove length check of Timer Status (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: count low-drive, error and arb-lost conditions (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add note about *_from_edid() function usage in drm (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_unconfigured() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_nb_transmit_canceled() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: don't set last_initiator if tx in progress (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: disable adapter in cec_devnode_unregister (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: not all messages were passed on when monitoring (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add support for Absolute Volume Control (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: log when claiming LA fails unexpectedly (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: drop activate_cnt, use state info instead (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: reconfigure if the PA changes during configuration (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: fix is_configuring state (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: stop trying LAs on CEC_TX_STATUS_TIMEOUT (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't unconfigure if already unconfigured (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add optional adap_configured callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add xfer_timeout_ms field (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: use call_op and check for !unregistered (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix interrupt en/disable handling (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: drop unused 'enabled' field from struct cec_pin (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix off-by-one SFT check (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: rename timer overrun variables (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: correctly pass on reply results (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: abort if the current transmit was canceled (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: call enable_adap on s_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: media/cec.h: document cec_adapter fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix a deadlock situation (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: safely unhook lists in cec_data (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: copy sequence field for the reply (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix trivial style warnings (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: add 'unregistered' checks (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't use flush_scheduled_work() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: Use fallthrough pseudo-keyword (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: remove unused waitq and phys_addrs fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: silence shift wrapping warning in __cec_s_log_addrs() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: move the core to a separate directory (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - net/iucv: Avoid explicit cpumask var allocation on stack (CKI Backport Bot) [RHEL-51631] {CVE-2024-42094} - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (Dick Kennedy) [RHEL-40400] - KVM: selftests: Make hyperv_clock require TSC based system clocksource (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Run clocksource dependent tests with hyperv_clocksource_tsc_page too (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Use generic sys_clocksource_is_tsc() in vmx_nested_tsc_scaling_test (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Generalize check_clocksource() from kvm_clock_test (Vitaly Kuznetsov) [RHEL-19027] - firmware: cs_dsp: Return error if block header overflows file (CKI Backport Bot) [RHEL-53646] {CVE-2024-42238} - firmware: cs_dsp: Validate payload length before processing block (CKI Backport Bot) [RHEL-53638] {CVE-2024-42237} - mm, slub: fix potential memoryleak in kmem_cache_open() (Waiman Long) [RHEL-38404] {CVE-2021-47466} - slub: don't panic for memcg kmem cache creation failure (Waiman Long) [RHEL-38404] {CVE-2021-47466} - wifi: ath11k: fix htt pktlog locking (Jose Ignacio Tornos Martinez) [RHEL-38317] {CVE-2023-52800} - wifi: ath11k: fix dfs radar event locking (Jose Ignacio Tornos Martinez) [RHEL-38165] {CVE-2023-52798} - lib/generic-radix-tree.c: Don't overflow in peek() (Waiman Long) [RHEL-37737] {CVE-2021-47432} - include/linux/generic-radix-tree.h: replace kernel.h with the necessary inclusions (Waiman Long) [RHEL-37737] {CVE-2021-47432} - EDAC/i10nm: Skip the absent memory controllers (Aristeu Rozanski) [RHEL-43236] - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (John Meneghini) [RHEL-38197] {CVE-2023-52809} - gfs2: Fix potential glock use-after-free on unmount (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: simplify gdlm_put_lock with out_free label (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: Remove ill-placed consistency check (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - nvme-fc: do not wait in vain when unloading module (Ewan D. Milne) [RHEL-33083] {CVE-2024-26846} - HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts (CKI Backport Bot) [RHEL-49698] {CVE-2022-48866} - scsi: qedf: Set qed_slowpath_params to zero before use (John Meneghini) [RHEL-9797] - scsi: qedf: Wait for stag work during unload (John Meneghini) [RHEL-9797] - scsi: qedf: Don't process stag work during unload and recovery (John Meneghini) [RHEL-9797] - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - mm: avoid overflows in dirty throttling logic (Audra Mitchell) [RHEL-51840] {CVE-2024-42131} - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - ACPI: fix NULL pointer dereference (Mark Langsdorf) [RHEL-37897] {CVE-2021-47289} - [rt] build kernel-rt-4.18.0-553.18.1.rt7.359.el8_10 [RHEL-53529] - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING (Ewan D. Milne) [RHEL-39805] {CVE-2024-36920} - tun: limit printing rate when illegal packet received by tun dev (Jon Maloy) [RHEL-35046] {CVE-2024-27013} - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu/mes: fix use-after-free issue (Michel Dänzer) [RHEL-44043] {CVE-2024-38581} - drm/amdgpu: Fix the null pointer when load rlc firmware (Michel Dänzer) [RHEL-30603] {CVE-2024-26649} - drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (Michel Dänzer) [RHEL-35160] {CVE-2024-27042} - net/sched: Fix UAF when resolving a clash (Xin Long) [RHEL-51014] {CVE-2024-41040} - tcp_metrics: validate source addr length (Guillaume Nault) [RHEL-52025] {CVE-2024-42154} - NFSv4/pnfs: Fix a use-after-free bug in open (Benjamin Coddington) [RHEL-35508] - NFSv4: Don't hold the layoutget locks across multiple RPC calls (Benjamin Coddington) [RHEL-35508] - scsi: qedf: Make qedf_execute_tmf() non-preemptible (John Meneghini) [RHEL-51799] {CVE-2024-42124} - Input: elantech - fix stack out of bound access in elantech_change_report_id() (CKI Backport Bot) [RHEL-41938] {CVE-2021-47097} - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (CKI Backport Bot) [RHEL-28982] {CVE-2023-52478} - drm/radeon: fix UBSAN warning in kv_dpm.c (CKI Backport Bot) [RHEL-48399] {CVE-2024-40988} - usb: core: Don't hold the device lock while sleeping in do_proc_control() (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - USB: core: Make do_proc_control() and do_proc_bulk() killable (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - scsi: qedi: Fix crash while reading debugfs attribute (CKI Backport Bot) [RHEL-48327] {CVE-2024-40978} - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CKI Backport Bot) [RHEL-48309] {CVE-2024-40977} - net: tcp: accept old ack during closing (Jamie Bainbridge) [RHEL-52433] - wifi: iwlwifi: mvm: don't read past the mfuart notifcation (CKI Backport Bot) [RHEL-48016] {CVE-2024-40941} - net/iucv: fix use after free in iucv_sock_close() (Mete Durlu) [RHEL-53988] - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (CKI Backport Bot) [RHEL-47908] {CVE-2024-40929} - Input: aiptek - properly check endpoint type (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - use descriptors of current altsetting (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - fix endpoint sanity check (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB (CKI Backport Bot) [RHEL-52373] {CVE-2024-42226} - wifi: mt76: replace skb_put with skb_put_zero (CKI Backport Bot) [RHEL-52366] {CVE-2024-42225} - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (CKI Backport Bot) [RHEL-47776] {CVE-2024-40912} - wifi: cfg80211: Lock wiphy in cfg80211_get_station (CKI Backport Bot) [RHEL-47758] {CVE-2024-40911} - VMCI: Use struct_size() in kmalloc() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() (Steve Best) [RHEL-37325] {CVE-2024-35944} - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values (Jose Ignacio Tornos Martinez) [RHEL-51761] {CVE-2024-42114} - usb: atm: cxacru: fix endpoint checking in cxacru_bind() (CKI Backport Bot) [RHEL-51442] {CVE-2024-41097} - nfs: handle error of rpc_proc_register() in init_nfs_fs() (Scott Mayhew) [RHEL-39904] {CVE-2024-36939} - drm/radeon: check bo_va->bo is non-NULL before using it (CKI Backport Bot) [RHEL-51184] {CVE-2024-41060} - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). (CKI Backport Bot) [RHEL-51027] {CVE-2024-41041} - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (CKI Backport Bot) [RHEL-50961] {CVE-2024-41035} - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). (CKI Backport Bot) [RHEL-44408] {CVE-2024-37356} - tcp: avoid too many retransmit packets (Florian Westphal) [RHEL-48627] {CVE-2024-41007} - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() (Florian Westphal) [RHEL-48627] - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Florian Westphal) [RHEL-48627] - tcp: refactor tcp_retransmit_timer() (Florian Westphal) [RHEL-48627] - tcp: exit if nothing to retransmit on RTO timeout (Florian Westphal) [RHEL-48627] - netfilter: nf_tables: Reject tables of unsupported family (Florian Westphal) [RHEL-21418] {CVE-2023-6040} - [rt] build kernel-rt-4.18.0-553.17.1.rt7.358.el8_10 [RHEL-53529] - kyber: fix out of bounds access when preempted (Ming Lei) [RHEL-27258] {CVE-2021-46984} - vfs: don't mod negative dentry count when on shrinker list (Brian Foster) [RHEL-35874] - fs/dcache: Re-use value stored to dentry->d_flags instead of re-reading (Brian Foster) [RHEL-35874] - fbmem: Do not delete the mode that is still in use (CKI Backport Bot) [RHEL-37796] {CVE-2021-47338} - netpoll: Fix race condition in netpoll_owner_active (CKI Backport Bot) [RHEL-49361] {CVE-2024-41005} - firmware: arm_scpi: Fix string overflow in SCPI genpd driver (Mark Salter) [RHEL-43702] {CVE-2021-47609} - ipv6: prevent possible NULL dereference in rt6_probe() (Guillaume Nault) [RHEL-48149] {CVE-2024-40960} - HID: i2c-hid-of: fix NULL-deref on failed power up (CKI Backport Bot) [RHEL-31598] {CVE-2024-26717} - cpufreq: amd-pstate: fix memory leak on CPU EPP exit (CKI Backport Bot) [RHEL-48489] {CVE-2024-40997} - x86/mm/pat: fix VM_PAT handling in COW mappings (Chris von Recklinghausen) [RHEL-37258] {CVE-2024-35877} - PCI/PM: Drain runtime-idle callbacks before driver removal (Myron Stowe) [RHEL-42937] {CVE-2024-35809} - PCI: Drop pci_device_remove() test of pci_dev->driver (Myron Stowe) [RHEL-42937] {CVE-2024-35809} - drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() (Mika Penttilä) [RHEL-26909] {CVE-2023-52470} - USB: core: Fix hang in usb_kill_urb by adding memory barriers (Desnes Nunes) [RHEL-43979] {CVE-2022-48760} - cifs: fix bad fids sent over wire (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB311_posix_mkdir (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB2_tcon (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB2_open (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB2_ioctl (Paulo Alcantara) [RHEL-52517] - selftests: forwarding: devlink_lib: Wait for udev events after reloading (Mark Langsdorf) [RHEL-47642] {CVE-2024-39501} - drivers: core: synchronize really_probe() and dev_uevent() (Mark Langsdorf) [RHEL-47642] {CVE-2024-39501} - udp: do not accept non-tunnel GSO skbs landing in a tunnel (Xin Long) [RHEL-42997] {CVE-2024-35884} - filelock: Remove locks reliably when fcntl/close race is detected (Bill O'Donnell) [RHEL-50170] {CVE-2024-41012} - Input: add bounds checking to input_set_capability() (Benjamin Tissoires) [RHEL-21413] {CVE-2022-48619} - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() (CKI Backport Bot) [RHEL-48130] {CVE-2024-40959} - blk-cgroup: fix list corruption from reorder of WRITE ->lqueued (Ming Lei) [RHEL-33695] - blk-cgroup: fix list corruption from resetting io stat (Ming Lei) [RHEL-33695] - net: do not leave a dangling sk pointer, when socket creation fails (CKI Backport Bot) [RHEL-48060] {CVE-2024-40954} - perf/x86/lbr: Filter vsyscall addresses (Michael Petlan) [RHEL-28991] {CVE-2023-52476} - vmci: prevent speculation leaks by sanitizing event in event_deliver() (CKI Backport Bot) [RHEL-47678] {CVE-2024-39499} - serial: core: fix transmit-buffer reset and memleak (Steve Best) [RHEL-38731] {CVE-2021-47527} - powerpc/pseries: Whitelist dtl slub object for copying to userspace (Mamatha Inamdar) [RHEL-51236] {CVE-2024-41065} - powerpc/eeh: avoid possible crash when edev->pdev changes (Mamatha Inamdar) [RHEL-51220] {CVE-2024-41064} - x86: stop playing stack games in profile_pc() (Steve Best) [RHEL-51643] {CVE-2024-42096} - mptcp: ensure snd_una is properly initialized on connect (Florian Westphal) [RHEL-47933 RHEL-47934] {CVE-2024-40931} - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet (CKI Backport Bot) [RHEL-47492] {CVE-2024-39506} - tun: add missing verification for short frame (Patrick Talbert) [RHEL-50194] {CVE-2024-41091} - tap: add missing verification for short frame (Patrick Talbert) [RHEL-50279] {CVE-2024-41090} - usb-storage: alauda: Check whether the media is initialized (Desnes Nunes) [RHEL-43708] {CVE-2024-38619} - usb-storage: alauda: Fix uninit-value in alauda_check_media() (Desnes Nunes) [RHEL-43708] {CVE-2024-38619} - hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37723] {CVE-2021-47384} - block: fix that util can be greater than 100% (Ming Lei) [RHEL-23074] - block: support to account io_ticks precisely (Ming Lei) [RHEL-23074] - watchdog: Fix possible use-after-free by calling del_timer_sync() (Steve Best) [RHEL-38795] {CVE-2021-47321} - hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37719] {CVE-2021-47385} - mlxsw: spectrum: Protect driver from buggy firmware (CKI Backport Bot) [RHEL-42245] {CVE-2021-47560} - mlxsw: Verify the accessed index doesn't exceed the array length (CKI Backport Bot) [RHEL-42245] {CVE-2021-47560} - dm: call the resume method on internal suspend (Benjamin Marzinski) [RHEL-41835] {CVE-2024-26880} - tty: Fix out-of-bound vmalloc access in imageblit (Steve Best) [RHEL-37727] {CVE-2021-47383} - hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37715] {CVE-2021-47386} - hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs (Steve Best) [RHEL-37710] {CVE-2021-47393} - nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells (Steve Best) [RHEL-38436] {CVE-2021-47497} - driver core: auxiliary bus: Fix memory leak when driver_register() fail (Steve Best) [RHEL-37901] {CVE-2021-47287} - phylib: fix potential use-after-free (cki-backport-bot) [RHEL-43764] {CVE-2022-48754} - ptp: Fix possible memory leak in ptp_clock_register() (Hangbin Liu) [RHEL-38424] {CVE-2021-47455} - NFSv4: Fix memory leak in nfs4_set_security_label (CKI Backport Bot) [RHEL-51315] {CVE-2024-41076} - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER (CKI Backport Bot) [RHEL-51618] {CVE-2024-42090} - ftruncate: pass a signed offset (CKI Backport Bot) [RHEL-51598] {CVE-2024-42084} - af_unix: Fix garbage collector racing against connect() (Felix Maurer) [RHEL-34225] {CVE-2024-26923} - virtio-net: Add validation for used length (Laurent Vivier) [RHEL-42080] {CVE-2021-47352} - net: fix possible store tearing in neigh_periodic_work() (Antoine Tenart) [RHEL-42359] {CVE-2023-52522} - tunnels: fix out of bounds access when building IPv6 PMTU error (Antoine Tenart) [RHEL-41823] {CVE-2024-26665} - vt_ioctl: fix array_index_nospec in vt_setactivate (John W. Linville) [RHEL-49141] {CVE-2022-48804} - Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() (CKI Backport Bot) [RHEL-38302] {CVE-2023-52840} - netns: Make get_net_ns() handle zero refcount net (Antoine Tenart) [RHEL-48105] {CVE-2024-40958} - tracing: Ensure visibility when inserting an element into tracing_map (Michael Petlan) [RHEL-30457] {CVE-2024-26645} - KVM: s390: fix LPSWEY handling (CKI Backport Bot) [RHEL-50072] - firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files (CKI Backport Bot) [RHEL-51144] {CVE-2024-41056} - SUNRPC: Fix a race to wake a sync task (Benjamin Coddington) [RHEL-11843] - firmware: cs_dsp: Fix overflow checking of wmfw header (CKI Backport Bot) [RHEL-50999] {CVE-2024-41039} - firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers (CKI Backport Bot) [RHEL-50987] {CVE-2024-41038} - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (Xin Long) [RHEL-48471] {CVE-2024-40995} - net: fix out-of-bounds access in ops_init (Xin Long) [RHEL-43185] {CVE-2024-36883} - x86/mce/therm_throt: Undo thermal polling properly on CPU offline (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Do not access uninitialized therm_work (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Mark throttle_active_work() as __maybe_unused (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Mask out read-only and reserved MSR bits (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Optimize notifications of thermal throttle (Steve Best) [RHEL-45310] - jiffies: add utility function to calculate delta in ms (Steve Best) [RHEL-45310] - x86/mce: Lower throttling MCE messages' priority to warning (Steve Best) [RHEL-45310] - dmaengine: idxd: Fix oops during rmmod on single-CPU platforms (Eder Zulian) [RHEL-37361] {CVE-2024-35989} - xfs: don't walk off the end of a directory data block (CKI Backport Bot) [RHEL-50879] {CVE-2024-41013} - xfs: add bounds checking to xlog_recover_process_data (CKI Backport Bot) [RHEL-50856] {CVE-2024-41014} - dm-crypt: limit the size of encryption requests (Benjamin Marzinski) [RHEL-29330] - netfilter: flowtable: remove nf_ct_l4proto_find() call (Florian Westphal) [RHEL-49589] - [rt] build kernel-rt-4.18.0-553.16.1.rt7.357.el8_10 [RHEL-44553] - x86/bhi: Fix incorrect CLEAR_BRANCH_HISTORY position in entry_INT80_compat (Waiman Long) [RHEL-50648] - [rt] build kernel-rt-4.18.0-553.15.1.rt7.356.el8_10 [RHEL-44553] - Revert "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-44613] - ionic: fix use after netif_napi_del() (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - ionic: clean interrupt before enabling queue to avoid credit race (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change (CKI Backport Bot) [RHEL-49321] {CVE-2021-47624} - xhci: Handle TD clearing for multiple streams case (CKI Backport Bot) [RHEL-47882] {CVE-2024-40927} - net: openvswitch: Fix Use-After-Free in ovs_ct_exit (cki-backport-bot) [RHEL-36362] {CVE-2024-27395} - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: fix vlan use-after-free (cki-backport-bot) [RHEL-43721] {CVE-2024-36979} - irqchip/gic-v3-its: Prevent double free on error (Charles Mirabile) [RHEL-37022] {CVE-2024-35847} - irqchip/gic-v3-its: Fix potential VPE leak on error (Charles Mirabile) [RHEL-37744] {CVE-2021-47373} - i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() (Charles Mirabile) [RHEL-34735] {CVE-2022-48632} - iommu/dma: fix zeroing of bounce buffer padding used by untrusted devices (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: remove alloc_size argument to swiotlb_tbl_map_single() (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: fix swiotlb_bounce() to do partial sync's correctly (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Reinstate page-alignment for mappings >= PAGE_SIZE (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix alignment checks when both allocation and DMA masks are present (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix double-allocation of slots due to broken alignment handling (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (cki-backport-bot) [RHEL-44441] {CVE-2024-31076} - [rt] build kernel-rt-4.18.0-553.14.1.rt7.355.el8_10 [RHEL-44553] - s390/qeth: Fix kernel panic after setting hsuid (Mete Durlu) [RHEL-49754] - perf/core: Protect event sibling list locking against interrupt inversion (Daniel Vacek) [RHEL-31798] - vt: fix unicode buffer corruption when deleting characters (Steve Best) [RHEL-36936] {CVE-2024-35823} - cifs: translate network errors on send to -ECONNABORTED (Paulo Alcantara) [RHEL-36754] - xfs: don't block in busy flushing when freeing extents (Brian Foster) [RHEL-7984] - xfs: allow extent free intents to be retried (Brian Foster) [RHEL-7984] - xfs: pass alloc flags through to xfs_extent_busy_flush() (Brian Foster) [RHEL-7984] - xfs: use deferred frees for btree block freeing (Brian Foster) [RHEL-7984] - xfs: fix bounds check in xfs_defer_agfl_block() (Brian Foster) [RHEL-7984] - xfs: validate block number being freed before adding to xefi (Brian Foster) [RHEL-7984] - xfs: rename xfs_bmap_add_free to xfs_free_extent_later (Brian Foster) [RHEL-7984] - usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (Desnes Nunes) [RHEL-36803] {CVE-2024-35790} - stm class: Fix a double free in stm_register_device() (Steve Best) [RHEL-44514] {CVE-2024-38627} - s390/qeth: Fix potential loss of L3-IP@ in case of network issues (Mete Durlu) [RHEL-49755] - tls: fix missing memory barrier in tls_init (cki-backport-bot) [RHEL-44471] {CVE-2024-36489} - xfs: fix log recovery buffer allocation for the legacy h_size fixup (Bill O'Donnell) [RHEL-46473] {CVE-2024-39472} - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: use __for_each_thread() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - exit: Use the correct exit_code in /proc/<pid>/stat (Brian Foster) [RHEL-31562] {CVE-2024-26686} - scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool (Ewan D. Milne) [RHEL-38283] {CVE-2023-52811} - scsi: qla2xxx: Fix double free of fcport (Ewan D. Milne) [RHEL-39549] {CVE-2024-26929} - scsi: qla2xxx: Fix double free of the ha->vp_map pointer (Ewan D. Milne) [RHEL-39549] {CVE-2024-26930} - scsi: qla2xxx: Fix command flush on cable pull (Ewan D. Milne) [RHEL-39549] {CVE-2024-26931} - [rt] build kernel-rt-4.18.0-553.13.1.rt7.354.el8_10 [RHEL-44553] - redhat: remove handling of deleted rhdocs/ directory from genspec.sh (Denys Vlasenko) - x86/bugs: Fix BHI retpoline check (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI handling of RRSBA (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr' (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI documentation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix return type of spectre_bhi_state() (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Make CONFIG_SPECTRE_BHI_ON the default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Mitigate KVM by default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add BHI mitigation knob (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Enumerate Branch History Injection (BHI) bug (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Define SPEC_CTRL_BHI_DIS_S (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add support for clearing branch history at syscall entry (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file (Waiman Long) [RHEL-28202] - perf/x86/amd/lbr: Use freeze based on availability (Waiman Long) [RHEL-28202] - Documentation/kernel-parameters: Add spec_rstack_overflow to mitigations=off (Waiman Long) [RHEL-28202] - KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace (Waiman Long) [RHEL-28202] - x86/bugs: Reset speculation control settings on init (Waiman Long) [RHEL-28202] - KVM: x86: Update KVM-only leaf handling to allow for 100% KVM-only leafs (Waiman Long) [RHEL-28202] - KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest (Waiman Long) [RHEL-28202] - mptcp: ensure snd_nxt is properly initialized on connect (Davide Caratti) [RHEL-39865] {CVE-2024-36889} - powerpc/pseries: Enforce hcall result buffer validity and size (Mamatha Inamdar) [RHEL-48291] {CVE-2024-40974} - wifi: mac80211: fix potential key use-after-free (Jose Ignacio Tornos Martinez) [RHEL-28007] {CVE-2023-52530} - cppc_cpufreq: Fix possible null pointer dereference (Mark Langsdorf) [RHEL-44137] {CVE-2024-38573} - net/sched: act_mirred: use the backlog for mirred ingress (Davide Caratti) [RHEL-31718] {CVE-2024-26740} - vfio/pci: Lock external INTx masking ops (Alex Williamson) [RHEL-31922] {CVE-2024-26810} - net: sched: sch_multiq: fix possible OOB write in multiq_tune() (Davide Caratti) [RHEL-43464] {CVE-2024-36978} - tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized (Guillaume Nault) [RHEL-37850] {CVE-2021-47304} - pstore/ram: Fix crash when setting number of cpus to an odd number (Lenny Szubowicz) [RHEL-29471] {CVE-2023-52619} - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node (Jocelyn Falempe) [RHEL-37101] {CVE-2023-52662} - drm/vmwgfx: Fix the lifetime of the bo cursor memory (Jocelyn Falempe) [RHEL-36962] {CVE-2024-35810} - drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed (Jocelyn Falempe) [RHEL-34987] {CVE-2024-26940} - drm/vmwgfx: Unmap the surface before resetting it on a plane state (Jocelyn Falempe) [RHEL-35217] {CVE-2023-52648} - drm/vmwgfx: Fix invalid reads in fence signaled events (Jocelyn Falempe) [RHEL-40010] {CVE-2024-36960} - block: Fix wrong offset in bio_truncate() (Ming Lei) [RHEL-43782] {CVE-2022-48747} - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CKI Backport Bot) [RHEL-46913] {CVE-2024-39487} - net: fix __dst_negative_advice() race (Xin Long) [RHEL-41183] {CVE-2024-36971} - igc: avoid returning frame twice in XDP_REDIRECT (Corinna Vinschen) [RHEL-33264] {CVE-2024-26853} - mac802154: fix llsec key resources release in mac802154_llsec_key_del (Steve Best) [RHEL-34967] {CVE-2024-26961} - cpufreq: exit() callback is optional (Mark Langsdorf) [RHEL-43840] {CVE-2024-38615} - cifs: prevent infinite recursion in CIFSGetDFSRefer() (Paulo Alcantara) [RHEL-34672] - cifs: lock chan_lock outside match_session (Paulo Alcantara) [RHEL-34672] - smb3: workaround negprot bug in some Samba servers (Paulo Alcantara) [RHEL-34672] - smb3: use netname when available on secondary channels (Paulo Alcantara) [RHEL-34672] - smb3: fix empty netname context on secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: populate empty hostnames for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: always iterate smb sessions using primary channel (Paulo Alcantara) [RHEL-34672] - cifs: Fix connections leak when tlink setup failed (Paulo Alcantara) [RHEL-34672] - cifs: Fix memory leak when build ntlmssp negotiate blob failed (Paulo Alcantara) [RHEL-34672] - cifs: always initialize struct msghdr smb_msg completely (Paulo Alcantara) [RHEL-34672] - cifs: don't send down the destination address to sendmsg for a SOCK_STREAM (Paulo Alcantara) [RHEL-34672] - cifs: revalidate mapping when doing direct writes (Paulo Alcantara) [RHEL-34672] - cifs: skip extra NULL byte in filenames (Paulo Alcantara) [RHEL-34672] - cifs: list_for_each() -> list_for_each_entry() (Paulo Alcantara) [RHEL-34672] - smb2: small refactor in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - cifs: Fix crash on unload of cifs_arc4.ko (Paulo Alcantara) [RHEL-34672] - cifs: remove check of list iterator against head past the loop body (Paulo Alcantara) [RHEL-34672] - cifs: fix reconnect on smb3 mount types (Paulo Alcantara) [RHEL-34672] - cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (Paulo Alcantara) [RHEL-34672] - cifs: skip trailing separators of prefix paths (Paulo Alcantara) [RHEL-34672] - cifs: fix ntlmssp on old servers (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL ptr dereference in refresh_mounts() (Paulo Alcantara) [RHEL-34672] - cifs: do not skip link targets when an I/O fails (Paulo Alcantara) [RHEL-34672] - cifs: fix confusing unneeded warning message on smb2.1 and earlier (Paulo Alcantara) [RHEL-34672] - smb3: fix snapshot mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix workstation_name for multiuser mounts (Paulo Alcantara) [RHEL-34672] - cifs: alloc_path_with_tree_prefix: do not append sep. if the path is empty (Paulo Alcantara) [RHEL-34672] - cifs: free ntlmsspblob allocated in negotiate (Paulo Alcantara) [RHEL-34672] - cifs: avoid use of dstaddr as key for fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: add server conn_id to fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: fix missed refcounting of ipc tcon (Paulo Alcantara) [RHEL-34672] - smb2: clarify rc initialization in smb2_reconnect (Paulo Alcantara) [RHEL-34672] - cifs: populate server_hostname for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should be set on new server (Paulo Alcantara) [RHEL-34672] - cifs: introduce cifs_ses_mark_for_reconnect() helper (Paulo Alcantara) [RHEL-34672] - cifs: protect srv_count with cifs_tcp_ses_lock (Paulo Alcantara) [RHEL-34672] - cifs: move debug print out of spinlock (Paulo Alcantara) [RHEL-34672] - cifs: do not duplicate fscache cookie for secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: connect individual channel servers to primary channel server (Paulo Alcantara) [RHEL-34672] - cifs: protect session channel fields with chan_lock (Paulo Alcantara) [RHEL-34672] - cifs: do not negotiate session if session already exists (Paulo Alcantara) [RHEL-34672] - smb3: do not setup the fscache_super_cookie until fsinfo initialized (Paulo Alcantara) [RHEL-34672] - cifs: fix potential use-after-free bugs (Paulo Alcantara) [RHEL-34672] - cifs: release lock earlier in dequeue_mid error case (Paulo Alcantara) [RHEL-34672] - smb3: remove trivial dfs compile warning (Paulo Alcantara) [RHEL-34672] - cifs: support nested dfs links over reconnect (Paulo Alcantara) [RHEL-34672] - cifs: for compound requests, use open handle if possible (Paulo Alcantara) [RHEL-34672] - cifs: split out dfs code from cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant (Paulo Alcantara) [RHEL-34672] - cifs: introduce new helper for cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: fix print of hdr_flags in dfscache_proc_show() (Paulo Alcantara) [RHEL-34672] - cifs: send workstation name during ntlmssp session setup (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should not share socket with future sessions (Paulo Alcantara) [RHEL-34672] - smb3: add dynamic trace points for socket connection (Paulo Alcantara) [RHEL-34672] - cifs: Move SMB2_Create definitions to the shared area (Paulo Alcantara) [RHEL-34672] - cifs: Move more definitions into the shared area (Paulo Alcantara) [RHEL-34672] - cifs: move NEGOTIATE_PROTOCOL definitions out into the common area (Paulo Alcantara) [RHEL-34672] - cifs: Create a new shared file holding smb2 pdu definitions (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect check for null pointer in header_assemble (Paulo Alcantara) [RHEL-34672] - smb3: correct server pointer dereferencing check to be more consistent (Paulo Alcantara) [RHEL-34672] - cifs: Deal with some warnings from W=1 (Paulo Alcantara) [RHEL-34672] - cifs: fix a sign extension bug (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect kernel doc comments (Paulo Alcantara) [RHEL-34672] - cifs: remove pathname for file from SPDX header (Paulo Alcantara) [RHEL-34672] - cifs: move SMB FSCTL definitions to common code (Paulo Alcantara) [RHEL-34672] - cifs: rename cifs_common to smbfs_common (Paulo Alcantara) [RHEL-34672] - cifs: update FSCTL definitions (Paulo Alcantara) [RHEL-34672] - cifs: cifs_md4 convert to SPDX identifier (Paulo Alcantara) [RHEL-34672] - cifs: create a MD4 module and switch cifs.ko to use it (Paulo Alcantara) [RHEL-34672] - cifs: fork arc4 and create a separate module for it for cifs and other users (Paulo Alcantara) [RHEL-34672] - smb3: fix posix extensions mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix wrong release in sess_alloc_buffer() failed path (Paulo Alcantara) [RHEL-34672] - CIFS: Fix a potencially linear read overflow (Paulo Alcantara) [RHEL-34672] - cifs: use the correct max-length for dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: create sd context must be a multiple of 8 (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp sessions of dfs connections (Paulo Alcantara) [RHEL-34672] - cifs: added WARN_ON for all the count decrements (Paulo Alcantara) [RHEL-34672] - cifs: fix missing null session check in mount (Paulo Alcantara) [RHEL-34672] - cifs: handle reconnect of tcon when there is no cached dfs referral (Paulo Alcantara) [RHEL-34672] - cifs: fix the out of range assignment to bit fields in parse_server_interfaces (Paulo Alcantara) [RHEL-34672] - smb3: fix typo in header file (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: Add support for negotiating signing algorithm (Paulo Alcantara) [RHEL-34672] - cifs: prevent NULL deref in cifs_compose_mount_options() (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL dereference in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - smbdirect: missing rc checks while waiting for rdma events (Paulo Alcantara) [RHEL-34672] - cifs: Avoid field over-reading memcpy() (Paulo Alcantara) [RHEL-34672] - smb311: remove dead code for non compounded posix query info (Paulo Alcantara) [RHEL-34672] - cifs: fix SMB1 error path in cifs_get_file_info_unix (Paulo Alcantara) [RHEL-34672] - smb3: fix uninitialized value for port in witness protocol move (Paulo Alcantara) [RHEL-34672] - cifs: fix unneeded null check (Paulo Alcantara) [RHEL-34672] - cifs: use SPDX-Licence-Identifier (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in cifs_debug.c (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in smb2misc.c (Paulo Alcantara) [RHEL-34672] - cifs: missed ref-counting smb session in find (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp servers with dfs mounts (Paulo Alcantara) [RHEL-34672] - cifs: set a minimum of 2 minutes for refreshing dfs cache (Paulo Alcantara) [RHEL-34672] - cifs: Remove unused inline function is_sysvol_or_netlogon() (Paulo Alcantara) [RHEL-34672] - cifs: remove duplicated prototype (Paulo Alcantara) [RHEL-34672] - cifs: fix ipv6 formating in cifs_ses_add_channel (Paulo Alcantara) [RHEL-34672] - cifs: fix string declarations and assignments in tracepoints (Paulo Alcantara) [RHEL-34672] - cifs: fix memory leak in smb2_copychunk_range (Paulo Alcantara) [RHEL-34672] - SMB3: incorrect file id in requests compounded with open (Paulo Alcantara) [RHEL-34672] - smb3: if max_channels set to more than one channel request multichannel (Paulo Alcantara) [RHEL-34672] - smb3: do not attempt multichannel to server which does not support it (Paulo Alcantara) [RHEL-34672] - smb3: when mounting with multichannel include it in requested capabilities (Paulo Alcantara) [RHEL-34672] - cifs: simplify SWN code with dummy funcs instead of ifdefs (Paulo Alcantara) [RHEL-34672] - cifs: log mount errors using cifs_errorf() (Paulo Alcantara) [RHEL-34672] - cifs: switch build_path_from_dentry() to using dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: fix out-of-bound memory access when calling smb3_notify() at mount point (Paulo Alcantara) [RHEL-34672] - cifs: allocate buffer in the caller of build_path_from_dentry() (Paulo Alcantara) [RHEL-34672] - cifs: make build_path_from_dentry() return const char * (Paulo Alcantara) [RHEL-34672] - cifs: remove old dead code (Paulo Alcantara) [RHEL-34672] - fs: cifs: Remove repeated struct declaration (Paulo Alcantara) [RHEL-34672] - cifs: have cifs_fattr_to_inode() refuse to change type on live inode (Paulo Alcantara) [RHEL-34672] - cifs: have ->mkdir() handle race with another client sanely (Paulo Alcantara) [RHEL-34672] - do_cifs_create(): don't set ->i_mode of something we had not created (Paulo Alcantara) [RHEL-34672] - cifs: Silently ignore unknown oplock break handle (Paulo Alcantara) [RHEL-34672] - cifs: change noisy error message to FYI (Paulo Alcantara) [RHEL-34672] - cifs: print MIDs in decimal notation (Paulo Alcantara) [RHEL-34672] - cifs: minor simplification to smb2_is_network_name_deleted (Paulo Alcantara) [RHEL-34672] - TCON Reconnect during STATUS_NETWORK_NAME_DELETED (Paulo Alcantara) [RHEL-34672] - cifs: clarify hostname vs ip address in /proc/fs/cifs/DebugData (Paulo Alcantara) [RHEL-34672] - cifs: change confusing field serverName (to ip_addr) (Paulo Alcantara) [RHEL-34672] - cifs: Reformat DebugData and index connections by conn_id. (Paulo Alcantara) [RHEL-34672] - cifs: Identify a connection by a conn_id. (Paulo Alcantara) [RHEL-34672] - smb3: negotiate current dialect (SMB3.1.1) when version 3 or greater requested (Paulo Alcantara) [RHEL-34672] - smb3: Fix out-of-bounds bug in SMB2_negotiate() (Paulo Alcantara) [RHEL-34672] - fs/cifs: Simplify bool comparison. (Paulo Alcantara) [RHEL-34672] - fs/cifs: Assign boolean values to a bool variable (Paulo Alcantara) [RHEL-34672] - cifs: Avoid error pointer dereference (Paulo Alcantara) [RHEL-34672] - cifs: Re-indent cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Unlock on errors in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Delete a stray unlock in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Tracepoints and logs for tracing credit changes. (Paulo Alcantara) [RHEL-34672] - cifs: Fix some error pointers handling detected by static checker (Paulo Alcantara) [RHEL-34672] - smb3: remind users that witness protocol is experimental (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: do not log warning message if server doesn't populate salt (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: update comments clarifying SPNEGO info in negprot response (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot rsp (Paulo Alcantara) [RHEL-34672] - SMB3: avoid confusing warning message on mount to Azure (Paulo Alcantara) [RHEL-34672] - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (Nigel Croxon) [RHEL-46662] {CVE-2024-39476} - net: fix information leakage in /proc/net/ptype (Hangbin Liu) [RHEL-44000] {CVE-2022-48757} - usb: typec: ucsi: Limit read size on v1.2 (Desnes Nunes) [RHEL-37286] {CVE-2024-35924} - minmax: relax check to allow comparison between unsigned arguments and signed constants (Desnes Nunes) [RHEL-37286] - minmax: allow comparisons of 'int' against 'unsigned char/short' (Desnes Nunes) [RHEL-37286] - minmax: allow min()/max()/clamp() if the arguments have the same signedness. (Desnes Nunes) [RHEL-37286] - minmax: add umin(a, b) and umax(a, b) (Desnes Nunes) [RHEL-37286] - minmax: fix header inclusions (Desnes Nunes) [RHEL-37286] - minmax: clamp more efficiently by avoiding extra comparison (Desnes Nunes) [RHEL-37286] - minmax: sanity check constant bounds when clamping (Desnes Nunes) [RHEL-37286] - tracing: Define the is_signed_type() macro once (Desnes Nunes) [RHEL-37286] - linux/bits.h: fix compilation error with GENMASK (Desnes Nunes) [RHEL-37286] - x86/apic: Mask IOAPIC entries when disabling the local APIC (Lenny Szubowicz) [RHEL-18077] - userfaultfd: fix a race between writeprotect and exit_mmap() (Rafael Aquini) [RHEL-38410] {CVE-2021-47461} - mm: khugepaged: skip huge page collapse for special files (Waiman Long) [RHEL-38446] {CVE-2021-47491} - cachefiles: fix memory leak in cachefiles_add_cache() (Andrey Albershteyn) [RHEL-33109] {CVE-2024-26840} - drm/amd/display: Implement bounds check for stream encoder creation in DCN301 (Michel Dänzer) [RHEL-31429] {CVE-2024-26660} - net/mlx5: Discard command completions in internal error (Kamal Heib) [RHEL-44231] {CVE-2024-38555} - drm: Don't unref the same fb many times by mistake due to deadlock handling (CKI Backport Bot) [RHEL-29011] {CVE-2023-52486} - md: fix resync softlockup when bitmap size is less than array size (Nigel Croxon) [RHEL-43942] {CVE-2024-38598} - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation (Davide Caratti) [RHEL-39712] {CVE-2024-36017} - netfilter: nf_tables: discard table flag update with pending basechain deletion (Phil Sutter) [RHEL-37205] {CVE-2024-35897} - netfilter: nf_tables: reject table flag and netdev basechain updates (Phil Sutter) [RHEL-37205] - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (Ewan D. Milne) [RHEL-40172] {CVE-2024-36924} - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (Ewan D. Milne) [RHEL-40172] {CVE-2024-36952} - netfilter: nf_tables: fix memleak in map from abort path (Phil Sutter) [RHEL-35052] {CVE-2024-27011} - netfilter: nf_tables: reject new basechain after table flag update (Phil Sutter) [RHEL-37193] {CVE-2024-35900} - netfilter: nf_tables: flush pending destroy work before exit_net release (Phil Sutter) [RHEL-37197] {CVE-2024-35899} - netfilter: complete validation of user input (Phil Sutter) [RHEL-37210] - netfilter: validate user input for expected length (Phil Sutter) [RHEL-37210] {CVE-2024-35896} - netfilter: tproxy: bail out if IP has been disabled on the device (Phil Sutter) [RHEL-44363] {CVE-2024-36270} - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (Phil Sutter) [RHEL-44532] {CVE-2024-36286} - netfilter: nf_tables: do not compare internal table flags on updates (Phil Sutter) [RHEL-35114] {CVE-2024-27065} - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (Phil Sutter) [RHEL-35028] {CVE-2024-27019} - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (Phil Sutter) [RHEL-35024] {CVE-2024-27020} - netfilter: nf_tables: __nft_expr_type_get() selects specific family type (Phil Sutter) [RHEL-35024] - netfilter: conntrack: serialize hash resizes and cleanups (Phil Sutter) [RHEL-37703] {CVE-2021-47408} - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (Phil Sutter) [RHEL-34217] {CVE-2024-26925} - netfilter: nf_tables: release batch on table validation from abort path (Phil Sutter) [RHEL-34217] - ipvlan: add ipvlan_route_v6_outbound() helper (Davide Caratti) [RHEL-38319] {CVE-2023-52796} - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.23.1.rt7.364.el8_10 [RHEL-59541] - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002] - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924} - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042} - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070} - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898} - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301} - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976} - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540} - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284} - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857} - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924} - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983} - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854} - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936} - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093} - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961} - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880} - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244} - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984} - [rt] build kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 [RHEL-53529] - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071} - [rt] build kernel-rt-4.18.0-553.21.1.rt7.362.el8_10 [RHEL-53529] - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874] - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558} - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441} - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904} - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322} - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246} - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008} - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228} - [rt] build kernel-rt-4.18.0-553.20.1.rt7.361.el8_10 [RHEL-53529] - KVM: arm64: Disassociate vcpus from redistributor region on teardown (Shaoqin Huang) [RHEL-48417] {CVE-2024-40989} - devres: Fix memory leakage caused by driver API devm_free_percpu() (CKI Backport Bot) [RHEL-55597] {CVE-2024-43871} - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (Izabela Bakollari) [RHEL-26680] {CVE-2024-26600} - nvmet-fc: avoid deadlock on delete association path (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - nvmet-fc: release reference on target port (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - ACPI: LPIT: Avoid u32 multiplication overflow (Mark Langsdorf) [RHEL-37062] {CVE-2023-52683} - sched/deadline: Fix task_struct reference leak (Phil Auld) [RHEL-50904] {CVE-2024-41023} - nfsd: fix crash on LOCKT on reexported NFSv3 (Benjamin Coddington) [RHEL-31515] - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path (CKI Backport Bot) [RHEL-26570] {CVE-2024-26595} - mlxsw: spectrum_acl_tcam: Move devlink param to TCAM code (Ivan Vecera) [RHEL-26570] {CVE-2024-26595} - ACPI: extlog: fix NULL pointer dereference check (Mark Langsdorf) [RHEL-29110] {CVE-2023-52605} - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() (Mark Langsdorf) [RHEL-33198] {CVE-2024-26894} - mm: prevent derefencing NULL ptr in pfn_section_valid() (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - mm, kmsan: fix infinite recursion due to RCU critical section (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - cipso: make cipso_v4_skbuff_delattr() fully remove the CIPSO options (Ondrej Mosnacek) [RHEL-30904] - cipso: fix total option length computation (Ondrej Mosnacek) [RHEL-30904] - ext4: do not create EA inode under buffer lock (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: check the return value of ext4_xattr_inode_dec_ref() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (Carlos Maiolino) [RHEL-48507] {CVE-2024-40998} - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - [rt] build kernel-rt-4.18.0-553.19.1.rt7.360.el8_10 [RHEL-53529] - drm/i915/vma: Fix UAF on destroy against retire race (Mika Penttilä) [RHEL-35222] {CVE-2024-26939} - RHEL-48620 (Kenneth Yin) [RHEL-48620] - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (CKI Backport Bot) [RHEL-42721] {CVE-2024-26855} - net: usb: asix: do not force pause frames support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix "can't send until first packet is send" issue (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix modprobe "sysfs: cannot create duplicate filename" (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: add proper error handling of usb read errors (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix wrong return value in asix_check_host_enable() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix uninit-value in asix_mdio_read() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: fix boolconv.cocci warnings (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: do not call phy_disconnect() for ax88178 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: move embedded PHY detection as early as possible (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix uninit value bugs (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add missing stop (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: suspend PHY on driver probe (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: manage PHY PM from MAC (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: add error handling for asix_mdio_* functions (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add phylib support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: refactor asix_read_phy_addr() and handle errors on return (Ken Cox) [RHEL-28108] {CVE-2021-47101} - SUNRPC: always free ctxt when freeing deferred request (Jay Shin) [RHEL-40936] - SUNRPC: double free xprt_ctxt while still in use (Jay Shin) [RHEL-40936] - SUNRPC: Remove svc_rqst::rq_xprt_hlen (Jay Shin) [RHEL-40936] - SUNRPC: Remove dead code in svc_tcp_release_rqst() (Jay Shin) [RHEL-40936] - x86/bugs: Extend VMware Retbleed workaround to Nehalem & earlier CPUs (Waiman Long) [RHEL-48646] - wifi: iwlwifi: read txq->read_ptr under lock (Jose Ignacio Tornos Martinez) [RHEL-39797] {CVE-2024-36922} - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (John Meneghini) [RHEL-39908] {CVE-2024-36919} - nbd: always initialize struct msghdr completely (Ming Lei) [RHEL-29498] {CVE-2024-26638} - block: don't call rq_qos_ops->done_bio if the bio isn't tracked (Ming Lei) [RHEL-42151] {CVE-2021-47412} - nvmet: fix a possible leak when destroy a ctrl during qp establishment (Maurizio Lombardi) [RHEL-52013] {CVE-2024-42152} - ipv6: prevent NULL dereference in ip6_output() (Sabrina Dubroca) [RHEL-39912] {CVE-2024-36901} - ppp: reject claimed-as-LCP but actually malformed packets (Guillaume Nault) [RHEL-51052] {CVE-2024-41044} - leds: trigger: Unregister sysfs attributes before calling deactivate() (CKI Backport Bot) [RHEL-54834] {CVE-2024-43830} - crypto: bcm - Fix pointer arithmetic (cki-backport-bot) [RHEL-44108] {CVE-2024-38579} - scsi: qedf: Ensure the copied buf is NUL terminated (John Meneghini) [RHEL-44195] {CVE-2024-38559} - x86/bhi: Avoid warning in #DB handler due to BHI mitigation (Waiman Long) [RHEL-53657] {CVE-2024-42240} - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (CKI Backport Bot) [RHEL-47529] {CVE-2024-40901} - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (CKI Backport Bot) [RHEL-39843] {CVE-2024-36902} - net: usb: ax88179_178a: improve link status logs (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: improve reset check (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: fix link status when link is set to down/up (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: avoid writing the mac address before first reading (Jose Ignacio Tornos Martinez) [RHEL-45167] - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - media: cec: cec-api: add locking in cec_release() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid confusing "transmit timed out" message (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid recursive cec_claim_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: remove length check of Timer Status (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: count low-drive, error and arb-lost conditions (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add note about *_from_edid() function usage in drm (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_unconfigured() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_nb_transmit_canceled() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: don't set last_initiator if tx in progress (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: disable adapter in cec_devnode_unregister (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: not all messages were passed on when monitoring (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add support for Absolute Volume Control (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: log when claiming LA fails unexpectedly (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: drop activate_cnt, use state info instead (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: reconfigure if the PA changes during configuration (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: fix is_configuring state (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: stop trying LAs on CEC_TX_STATUS_TIMEOUT (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't unconfigure if already unconfigured (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add optional adap_configured callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add xfer_timeout_ms field (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: use call_op and check for !unregistered (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix interrupt en/disable handling (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: drop unused 'enabled' field from struct cec_pin (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix off-by-one SFT check (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: rename timer overrun variables (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: correctly pass on reply results (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: abort if the current transmit was canceled (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: call enable_adap on s_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: media/cec.h: document cec_adapter fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix a deadlock situation (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: safely unhook lists in cec_data (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: copy sequence field for the reply (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix trivial style warnings (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: add 'unregistered' checks (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't use flush_scheduled_work() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: Use fallthrough pseudo-keyword (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: remove unused waitq and phys_addrs fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: silence shift wrapping warning in __cec_s_log_addrs() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: move the core to a separate directory (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - net/iucv: Avoid explicit cpumask var allocation on stack (CKI Backport Bot) [RHEL-51631] {CVE-2024-42094} - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (Dick Kennedy) [RHEL-40400] - KVM: selftests: Make hyperv_clock require TSC based system clocksource (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Run clocksource dependent tests with hyperv_clocksource_tsc_page too (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Use generic sys_clocksource_is_tsc() in vmx_nested_tsc_scaling_test (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Generalize check_clocksource() from kvm_clock_test (Vitaly Kuznetsov) [RHEL-19027] - firmware: cs_dsp: Return error if block header overflows file (CKI Backport Bot) [RHEL-53646] {CVE-2024-42238} - firmware: cs_dsp: Validate payload length before processing block (CKI Backport Bot) [RHEL-53638] {CVE-2024-42237} - mm, slub: fix potential memoryleak in kmem_cache_open() (Waiman Long) [RHEL-38404] {CVE-2021-47466} - slub: don't panic for memcg kmem cache creation failure (Waiman Long) [RHEL-38404] {CVE-2021-47466} - wifi: ath11k: fix htt pktlog locking (Jose Ignacio Tornos Martinez) [RHEL-38317] {CVE-2023-52800} - wifi: ath11k: fix dfs radar event locking (Jose Ignacio Tornos Martinez) [RHEL-38165] {CVE-2023-52798} - lib/generic-radix-tree.c: Don't overflow in peek() (Waiman Long) [RHEL-37737] {CVE-2021-47432} - include/linux/generic-radix-tree.h: replace kernel.h with the necessary inclusions (Waiman Long) [RHEL-37737] {CVE-2021-47432} - EDAC/i10nm: Skip the absent memory controllers (Aristeu Rozanski) [RHEL-43236] - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (John Meneghini) [RHEL-38197] {CVE-2023-52809} - gfs2: Fix potential glock use-after-free on unmount (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: simplify gdlm_put_lock with out_free label (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: Remove ill-placed consistency check (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - nvme-fc: do not wait in vain when unloading module (Ewan D. Milne) [RHEL-33083] {CVE-2024-26846} - HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts (CKI Backport Bot) [RHEL-49698] {CVE-2022-48866} - scsi: qedf: Set qed_slowpath_params to zero before use (John Meneghini) [RHEL-9797] - scsi: qedf: Wait for stag work during unload (John Meneghini) [RHEL-9797] - scsi: qedf: Don't process stag work during unload and recovery (John Meneghini) [RHEL-9797] - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - mm: avoid overflows in dirty throttling logic (Audra Mitchell) [RHEL-51840] {CVE-2024-42131} - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - ACPI: fix NULL pointer dereference (Mark Langsdorf) [RHEL-37897] {CVE-2021-47289} - [rt] build kernel-rt-4.18.0-553.18.1.rt7.359.el8_10 [RHEL-53529] - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING (Ewan D. Milne) [RHEL-39805] {CVE-2024-36920} - tun: limit printing rate when illegal packet received by tun dev (Jon Maloy) [RHEL-35046] {CVE-2024-27013} - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu/mes: fix use-after-free issue (Michel Dänzer) [RHEL-44043] {CVE-2024-38581} - drm/amdgpu: Fix the null pointer when load rlc firmware (Michel Dänzer) [RHEL-30603] {CVE-2024-26649} - drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (Michel Dänzer) [RHEL-35160] {CVE-2024-27042} - net/sched: Fix UAF when resolving a clash (Xin Long) [RHEL-51014] {CVE-2024-41040} - tcp_metrics: validate source addr length (Guillaume Nault) [RHEL-52025] {CVE-2024-42154} - NFSv4/pnfs: Fix a use-after-free bug in open (Benjamin Coddington) [RHEL-35508] - NFSv4: Don't hold the layoutget locks across multiple RPC calls (Benjamin Coddington) [RHEL-35508] - scsi: qedf: Make qedf_execute_tmf() non-preemptible (John Meneghini) [RHEL-51799] {CVE-2024-42124} - Input: elantech - fix stack out of bound access in elantech_change_report_id() (CKI Backport Bot) [RHEL-41938] {CVE-2021-47097} - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (CKI Backport Bot) [RHEL-28982] {CVE-2023-52478} - drm/radeon: fix UBSAN warning in kv_dpm.c (CKI Backport Bot) [RHEL-48399] {CVE-2024-40988} - usb: core: Don't hold the device lock while sleeping in do_proc_control() (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - USB: core: Make do_proc_control() and do_proc_bulk() killable (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - scsi: qedi: Fix crash while reading debugfs attribute (CKI Backport Bot) [RHEL-48327] {CVE-2024-40978} - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CKI Backport Bot) [RHEL-48309] {CVE-2024-40977} - net: tcp: accept old ack during closing (Jamie Bainbridge) [RHEL-52433] - wifi: iwlwifi: mvm: don't read past the mfuart notifcation (CKI Backport Bot) [RHEL-48016] {CVE-2024-40941} - net/iucv: fix use after free in iucv_sock_close() (Mete Durlu) [RHEL-53988] - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (CKI Backport Bot) [RHEL-47908] {CVE-2024-40929} - Input: aiptek - properly check endpoint type (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - use descriptors of current altsetting (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - fix endpoint sanity check (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB (CKI Backport Bot) [RHEL-52373] {CVE-2024-42226} - wifi: mt76: replace skb_put with skb_put_zero (CKI Backport Bot) [RHEL-52366] {CVE-2024-42225} - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (CKI Backport Bot) [RHEL-47776] {CVE-2024-40912} - wifi: cfg80211: Lock wiphy in cfg80211_get_station (CKI Backport Bot) [RHEL-47758] {CVE-2024-40911} - VMCI: Use struct_size() in kmalloc() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() (Steve Best) [RHEL-37325] {CVE-2024-35944} - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values (Jose Ignacio Tornos Martinez) [RHEL-51761] {CVE-2024-42114} - usb: atm: cxacru: fix endpoint checking in cxacru_bind() (CKI Backport Bot) [RHEL-51442] {CVE-2024-41097} - nfs: handle error of rpc_proc_register() in init_nfs_fs() (Scott Mayhew) [RHEL-39904] {CVE-2024-36939} - drm/radeon: check bo_va->bo is non-NULL before using it (CKI Backport Bot) [RHEL-51184] {CVE-2024-41060} - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). (CKI Backport Bot) [RHEL-51027] {CVE-2024-41041} - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (CKI Backport Bot) [RHEL-50961] {CVE-2024-41035} - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). (CKI Backport Bot) [RHEL-44408] {CVE-2024-37356} - tcp: avoid too many retransmit packets (Florian Westphal) [RHEL-48627] {CVE-2024-41007} - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() (Florian Westphal) [RHEL-48627] - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Florian Westphal) [RHEL-48627] - tcp: refactor tcp_retransmit_timer() (Florian Westphal) [RHEL-48627] - tcp: exit if nothing to retransmit on RTO timeout (Florian Westphal) [RHEL-48627] - netfilter: nf_tables: Reject tables of unsupported family (Florian Westphal) [RHEL-21418] {CVE-2023-6040} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.23.1.rt7.364.el8_10 [RHEL-59541] - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002] - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924} - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042} - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070} - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898} - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301} - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976} - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540} - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284} - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857} - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924} - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983} - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854} - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936} - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093} - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961} - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880} - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244} - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984} - [rt] build kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 [RHEL-53529] - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071} - [rt] build kernel-rt-4.18.0-553.21.1.rt7.362.el8_10 [RHEL-53529] - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874] - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558} - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441} - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904} - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322} - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246} - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008} - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228} - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.23.1.rt7.364.el8_10 [RHEL-59541] - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002] - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924} - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042} - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070} - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898} - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301} - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976} - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540} - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284} - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857} - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924} - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983} - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854} - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936} - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093} - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961} - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880} - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244} - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - [rt] build kernel-rt-4.18.0-553.35.1.rt7.376.el8_10 [RHEL-72569] - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480] - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480] - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396] - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - [rt] build kernel-rt-4.18.0-553.35.1.rt7.376.el8_10 [RHEL-72569] - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480] - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480] - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396] - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - [rt] build kernel-rt-4.18.0-553.35.1.rt7.376.el8_10 [RHEL-72569] - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480] - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480] - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396] - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.5.1.rt7.346.el8_10 [RHEL-34640] - tools/power/turbostat: Fix uncore frequency file string (David Arcari) [RHEL-29238] - tools/power turbostat: Expand probe_intel_uncore_frequency() (David Arcari) [RHEL-29238] - uio: Fix use-after-free in uio_open (Ricardo Robaina) [RHEL-26232] {CVE-2023-52439} - net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (Ken Cox) [RHEL-27316] {CVE-2021-47013} - keys: Fix linking a duplicate key to a keyring's assoc_array (David Howells) [RHEL-30772] - keys: Hoist locking out of __key_link_begin() (David Howells) [RHEL-30772] - keys: Break bits out of key_unlink() (David Howells) [RHEL-30772] - keys: Change keyring_serialise_link_sem to a mutex (David Howells) [RHEL-30772] - wifi: brcm80211: handle pmk_op allocation failure (Jose Ignacio Tornos Martinez) [RHEL-35150] {CVE-2024-27048} - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work (Jose Ignacio Tornos Martinez) [RHEL-35140] {CVE-2024-27052} - wifi: iwlwifi: mvm: ensure offloading TID queue exists (Jose Ignacio Tornos Martinez) [RHEL-35130] {CVE-2024-27056} - wifi: mt76: mt7921e: fix use-after-free in free_irq() (Jose Ignacio Tornos Martinez) [RHEL-34866] {CVE-2024-26892} - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete (Jose Ignacio Tornos Martinez) [RHEL-34189] {CVE-2024-26897} - wifi: iwlwifi: mvm: fix a crash when we run out of stations (Jose Ignacio Tornos Martinez) [RHEL-31547] {CVE-2024-26693} - wifi: iwlwifi: fix double-free bug (Jose Ignacio Tornos Martinez) [RHEL-31543] {CVE-2024-26694} - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (Jose Ignacio Tornos Martinez) [RHEL-29089] {CVE-2023-52594} - wifi: rt2x00: restart beacon queue when hardware reset (Jose Ignacio Tornos Martinez) [RHEL-29093] {CVE-2023-52595} - wifi: iwlwifi: fix a memory corruption (Jose Ignacio Tornos Martinez) [RHEL-28903] {CVE-2024-26610} - [rt] build kernel-rt-4.18.0-553.4.1.rt7.345.el8_10 [RHEL-34640] - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117] - net/mlx5e: Prevent deadlock while disabling aRFS (Kamal Heib) [RHEL-35041] {CVE-2024-27014} - x86/tsc: Defer marking TSC unstable to a worker (Wander Lairson Costa) [RHEL-32676] - x86/smpboot: Make TSC synchronization function call based (Wander Lairson Costa) [RHEL-32676] - net: usb: fix possible use-after-free in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - net: usb: fix memory leak in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - [rt] build kernel-rt-4.18.0-552.3.1.rt7.344.el8_10 [RHEL-34640] - netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (Phil Sutter) [RHEL-30076] {CVE-2024-26643} - netfilter: nf_tables: disallow anonymous set with timeout flag (Phil Sutter) [RHEL-30080] {CVE-2024-26642} - selftests/bpf: Fix pyperf180 compilation failure with clang18 (Artem Savkov) [RHEL-35576] - md/raid5: fix atomicity violation in raid5_cache_count (Nigel Croxon) [RHEL-27930] {CVE-2024-23307} - usb: ulpi: Fix debugfs directory leak (Desnes Nunes) [RHEL-33287] {CVE-2024-26919} - powerpc/pseries: Fix potential memleak in papr_get_attr() (Mamatha Inamdar) [RHEL-35213] {CVE-2022-48669} - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (Desnes Nunes) [RHEL-35122] {CVE-2024-27059} - NFSv4: fairly test all delegations on a SEQ4_ revocation (Benjamin Coddington) [RHEL-34912] - USB: core: Fix deadlock in usb_deauthorize_interface() (Desnes Nunes) [RHEL-35002] {CVE-2024-26934} - usb: xhci: Add error handling in xhci_map_urb_for_dma (Desnes Nunes) [RHEL-34958] {CVE-2024-26964} - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (Ewan D. Milne) [RHEL-35076] {CVE-2024-26993} - xhci: handle isoc Babble and Buffer Overrun events properly (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - xhci: process isoc TD properly when there was a transaction error mid TD. (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - USB: core: Fix deadlock in port "disable" sysfs attribute (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - USB: core: Add hub_get() and hub_put() routines (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - netfilter: ipset: Missing gc cancellations fixed (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix performance regression in swap operation (Phil Sutter) [RHEL-30521] - netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test (Phil Sutter) [RHEL-30521] - x86/apic/x2apic: Fix a NULL pointer deref when handling a dying cpu (David Arcari) [RHEL-32516] - x86/coco: Disable 32-bit emulation by default on TDX and SEV (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Make IA32_EMULATION boot time configurable (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/elf: Make loading of 32bit processes depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Rename ignore_sysret() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/cpu: Don't write CSTAR MSR on Intel CPUs (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Introduce ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - [rt] build kernel-rt-4.18.0-552.2.1.rt7.343.el8_10 [RHEL-34640] - s390/ptrace: handle setting of fpc register correctly (Tobias Huschle) [RHEL-29106] {CVE-2023-52598} - net/smc: fix illegal rmb_desc access in SMC-D connection dump (Tobias Huschle) [RHEL-27746] {CVE-2024-26615} - wifi: mac80211: fix race condition on enabling fast-xmit (Jose Ignacio Tornos Martinez) [RHEL-31664] {CVE-2024-26779} - powerpc/fadump: make is_kdump_kernel() return false when fadump is active (Mamatha Inamdar) [RHEL-24401] - vmcore: remove dependency with is_kdump_kernel() for exporting vmcore (Mamatha Inamdar) [RHEL-24401] - mtd: require write permissions for locking and badblock ioctls (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - mtd: properly check all write ioctls for permissions (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - pid: take a reference when initializing `cad_pid` (Waiman Long) [RHEL-29420] {CVE-2021-47118} - i2c: i801: Don't generate an interrupt on bus reset (Prarit Bhargava) [RHEL-30325] {CVE-2021-47153} - RDMA/srpt: Do not register event handler until srpt device is fully setup (Kamal Heib) [RHEL-33224] {CVE-2024-26872} - ceph: switch to corrected encoding of max_xattr_size in mdsmap (Xiubo Li) [RHEL-26723] - ceph: switch to use cap_delay_lock for the unlink delay list (Xiubo Li) [RHEL-32870] - ceph: pass ino# instead of old_dentry if it's disconnected (Xiubo Li) [RHEL-32870] - fat: fix uninitialized field in nostale filehandles (Andrey Albershteyn) [RHEL-33186 RHEL-35108] {CVE-2024-26973} - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (Andrey Albershteyn) [RHEL-33186] {CVE-2024-26901} - idpf: limit the support to GCP only (Michal Schmidt) [RHEL-15652] - redhat/configs: enable CONFIG_IDPF (Michal Schmidt) [RHEL-15652] - idpf: remove the use of ETHTOOL_RING_USE_TCP_DATA_SPLIT (Michal Schmidt) [RHEL-15652] - idpf: workaround for unavailable skb page recycling (Michal Schmidt) [RHEL-15652] - idpf: always allocate a full page (Michal Schmidt) [RHEL-15652] - idpf: remove page pool stats code (Michal Schmidt) [RHEL-15652] - idpf: add minimal macros for __free(kfree) to work (Michal Schmidt) [RHEL-15652] - idpf: fixup include paths for RHEL 8 (Michal Schmidt) [RHEL-15652] - idpf: fix kernel panic on unknown packet types (Michal Schmidt) [RHEL-15652] - idpf: disable local BH when scheduling napi for marker packets (Michal Schmidt) [RHEL-15652] - idpf: remove dealloc vector msg err in idpf_intr_rel (Michal Schmidt) [RHEL-15652] - idpf: fix minor controlq issues (Michal Schmidt) [RHEL-15652] - idpf: prevent deinit uninitialized virtchnl core (Michal Schmidt) [RHEL-15652] - idpf: cleanup virtchnl cruft (Michal Schmidt) [RHEL-15652] - idpf: refactor idpf_recv_mb_msg (Michal Schmidt) [RHEL-15652] - idpf: add async_handler for MAC filter messages (Michal Schmidt) [RHEL-15652] - idpf: refactor remaining virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor queue related virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor vport virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: implement virtchnl transaction manager (Michal Schmidt) [RHEL-15652] - idpf: add idpf_virtchnl.h (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler padding in virtchnl2_ptype struct (Michal Schmidt) [RHEL-15652] - idpf: distinguish vports by the dev_port attribute (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler introduced padding in virtchnl2_rss_key struct (Michal Schmidt) [RHEL-15652] - idpf: fix corrupted frames and skb leaks in singleq mode (Michal Schmidt) [RHEL-15652] - idpf: refactor some missing field get/prep conversions (Michal Schmidt) [RHEL-15652] - idpf: add get/set for Ethtool's header split ringparam (Michal Schmidt) [RHEL-15652] - idpf: fix potential use-after-free in idpf_tso() (Michal Schmidt) [RHEL-15652] - idpf: cancel mailbox work in error path (Michal Schmidt) [RHEL-15652] - idpf: set scheduling mode for completion queue (Michal Schmidt) [RHEL-15652] - idpf: add SRIOV support and other ndo_ops (Michal Schmidt) [RHEL-15652] - idpf: add ethtool callbacks (Michal Schmidt) [RHEL-15652] - idpf: add singleq start_xmit and napi poll (Michal Schmidt) [RHEL-15652] - idpf: add RX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add TX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add splitq start_xmit (Michal Schmidt) [RHEL-15652] - idpf: initialize interrupts and enable vport (Michal Schmidt) [RHEL-15652] - idpf: configure resources for RX queues (Michal Schmidt) [RHEL-15652] - idpf: configure resources for TX queues (Michal Schmidt) [RHEL-15652] - idpf: add ptypes and MAC filter support (Michal Schmidt) [RHEL-15652] - idpf: add create vport and netdev configuration (Michal Schmidt) [RHEL-15652] - idpf: add core init and interrupt request (Michal Schmidt) [RHEL-15652] - idpf: add controlq init and reset checks (Michal Schmidt) [RHEL-15652] - idpf: add module register and probe functionality (Michal Schmidt) [RHEL-15652] - virtchnl: add virtchnl version 2 ops (Michal Schmidt) [RHEL-15652] - net: netdev_queue: netdev_txq_completed_mb(): fix wake condition (Michal Schmidt) [RHEL-15652] - net: piggy back on the memory barrier in bql when waking queues (Michal Schmidt) [RHEL-15652] - net: provide macros for commonly copied lockless queue stop/wake code (Michal Schmidt) [RHEL-15652] - [rt] build kernel-rt-4.18.0-552.1.1.rt7.342.el8_10 [RHEL-34640] - build: Update RTBZ for 8.10 z-stream builds (Denys Vlasenko) - redhat: set DIST to el8_10 and ZSTREAM to yes for 8.10 (Denys Vlasenko) - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (Prarit Bhargava) [RHEL-32590] {CVE-2021-47185} - net: mana: Fix Rx DMA datasize and skb_over_panic (Cathy Avery) [RHEL-32579] - RDMA/srpt: Support specifying the srpt_service_guid parameter (Kamal Heib) [RHEL-31710] {CVE-2024-26744} - RDMA/qedr: Fix qedr_create_user_qp error flow (Kamal Heib) [RHEL-31714] {CVE-2024-26743} - hwmon: (coretemp) Fix out-of-bounds memory access (David Arcari) [RHEL-31305] {CVE-2024-26664} - RDMA/irdma: Fix KASAN issue with tasklet (Kamal Heib) [RHEL-15776] - net: bridge: use DEV_STATS_INC() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: Fix unwanted sign extension in netdev_stats_to_stats64() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: add atomic_long_t to net_device_stats fields (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net/sched: act_ct: fix skb leak and crash on ooo frags (Xin Long) [RHEL-29467] {CVE-2023-52610} - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Jose Ignacio Tornos Martinez) [RHEL-28015] {CVE-2023-52528} - RDMA/core: Fix uninit-value access in ib_get_eth_speed() (Kamal Heib) [RHEL-30130] - RDMA/core: Get IB width and speed from netdev (Kamal Heib) [RHEL-30130] - cpufreq: intel_pstate: Add Emerald Rapids support in no-HWP mode (Prarit Bhargava) [RHEL-29444] - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add (Mamatha Inamdar) [RHEL-29118] {CVE-2023-52607} - powerpc/lib: Validate size for vector operations (Mamatha Inamdar) [RHEL-29114] {CVE-2023-52606} - usb: hub: Guard against accesses to uninitialized BOS descriptors (Desnes Nunes) [RHEL-28986] {CVE-2023-52477} - media: uvcvideo: Fix OOB read (Desnes Nunes) [RHEL-27940] {CVE-2023-52565} - media: pvrusb2: fix use after free on context disconnection (Desnes Nunes) [RHEL-26498] {CVE-2023-52445} - i2c: i801: Fix block process call transactions (Prarit Bhargava) [RHEL-26478] {CVE-2024-26593} - overlay: disable EVM (Coiby Xu) [RHEL-19863] - evm: add support to disable EVM on unsupported filesystems (Coiby Xu) [RHEL-19863] - evm: don't copy up 'security.evm' xattr (Coiby Xu) [RHEL-19863] - net: ena: Remove ena_select_queue (Kamal Heib) [RHEL-14286] - media: dvbdev: Fix memory leak in dvb_media_device_free() (Prarit Bhargava) [RHEL-27254] {CVE-2020-36777} - gfs2: Fix invalid metadata access in punch_hole (Andrew Price) [RHEL-28784] - i2c: Fix a potential use after free (Prarit Bhargava) [RHEL-26849] {CVE-2019-25162} - i2c: validate user data in compat ioctl (Prarit Bhargava) [RHEL-27022] {CVE-2021-46934} - platform/x86: think-lmi: Fix reference leak (Prarit Bhargava) [RHEL-28030] {CVE-2023-52520} - vhost: use kzalloc() instead of kmalloc() followed by memset() (Jon Maloy) [RHEL-21505] {CVE-2024-0340} - RDMA/siw: Fix connection failure handling (Kamal Heib) [RHEL-28042] {CVE-2023-52513} - vt: fix memory overlapping when deleting chars in the buffer (Waiman Long) [RHEL-27778 RHEL-27779] {CVE-2022-48627} - x86/fpu: Stop relying on userspace for info to fault in xsave buffer (Steve Best) [RHEL-26669] {CVE-2024-26603} - mptcp: fix double-free on socket dismantle (Davide Caratti) [RHEL-22773] {CVE-2024-26782} - crypto: akcipher - Disable signing and decryption (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: akcipher - default implementations for request callbacks (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: testmgr - split akcipher tests by a key type (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - workqueue: Warn when a rescuer could not be created (Waiman Long) [RHEL-22136] - RDMA/cma: Avoid GID lookups on iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/cma: Deduplicate error flow in cma_validate_port() (Benjamin Coddington) [RHEL-12456] - RDMA/core: Set gid_attr.ndev for iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/siw: Fabricate a GID on tun and loopback devices (Benjamin Coddington) [RHEL-12456] - eventpoll: fix missing wakeup for ovflist in ep_poll_callback (Luis Claudio R. Goncalves) [RHEL-23022] - [rt] build kernel-rt-4.18.0-552.rt7.341.el8 [RHEL-5332] - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248] - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248] - [rt] build kernel-rt-4.18.0-551.rt7.340.el8 [RHEL-5332] - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742} - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992] - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992] - [rt] build kernel-rt-4.18.0-550.rt7.339.el8 [RHEL-5332] - mm/sparsemem: fix race in accessing memory_section->usage (Waiman Long) [RHEL-28875 RHEL-28876] {CVE-2023-52489} - mm: use __pfn_to_section() instead of open coding it (Waiman Long) [RHEL-28875] {CVE-2023-52489} - [rt] build kernel-rt-4.18.0-549.rt7.338.el8 [RHEL-5332] - dm-integrity: align the outgoing bio in integrity_recheck (Benjamin Marzinski) [RHEL-29678] - dm-integrity: fix a memory leak when rechecking the data (Benjamin Marzinski) [RHEL-29678] - RDMA/mana_ib: Add CQ interrupt support for RAW QP (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: query device capabilities (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: register RDMA device with GDMA (Maxim Levitsky) [RHEL-23934] - net: mana: add msix index sharing between EQs (Maxim Levitsky) [RHEL-23934] - net: mana: Fix spelling mistake "enforecement" -> "enforcement" (Maxim Levitsky) [RHEL-23934] - net :mana :Add remaining GDMA stats for MANA to ethtool (Maxim Levitsky) [RHEL-23934] - net: mana: Fix oversized sge0 for GSO packets (Maxim Levitsky) [RHEL-23934] - net: mana: Fix TX CQE error handling (Maxim Levitsky) [RHEL-23934] - net: mana: Add gdma stats to ethtool output for mana (Maxim Levitsky) [RHEL-23934] - net: mana: Fix MANA VF unload when hardware is unresponsive (Maxim Levitsky) [RHEL-23934] - net: mana: Configure hwc timeout from hardware (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (Maxim Levitsky) [RHEL-23934] - [rt] build kernel-rt-4.18.0-548.rt7.337.el8 [RHEL-5332] - gitlab-ci: enable arm64/s390x/ppc64le debug builds (Michael Hofmann) - arm64: Add missing bits of AmpereOne Spectre-BHB mitigation (Mark Salter) [RHEL-29005] - [rt] enable CONFIG_DRM_MGAG200_IOBURST_WORKAROUND (Jocelyn Falempe) [RHEL-13214] - drm/mgag200: Add a workaround for low-latency (Jocelyn Falempe) [RHEL-13214] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - [rt] build kernel-rt-4.18.0-553.8.1.rt7.349.el8_10 [RHEL-40882] - udf: Fix NULL pointer dereference in udf_symlink function (Pavel Reichl) [RHEL-37769] {CVE-2021-47353} - net: ti: fix UAF in tlan_remove_one (Jose Ignacio Tornos Martinez) [RHEL-38940] {CVE-2021-47310} - ARM: footbridge: fix PCI interrupt mapping (Myron Stowe) [RHEL-26971] {CVE-2021-46909} - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (Kamal Heib) [RHEL-37454] {CVE-2024-36004} - net/mlx5e: Fix mlx5e_priv_init() cleanup flow (Kamal Heib) [RHEL-37424] {CVE-2024-35959} - net/mlx5: Properly link new fs rules into the tree (Kamal Heib) [RHEL-37420] {CVE-2024-35960} - net/mlx5e: fix a potential double-free in fs_any_create_groups (Kamal Heib) [RHEL-37091] {CVE-2023-52667} - net: ena: Fix incorrect descriptor free behavior (Kamal Heib) [RHEL-37428] {CVE-2024-35958} - mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - mISDN: fix possible use-after-free in HFC_cleanup() (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - implement dh fallback for primes > 4K (Vladis Dronov) [RHEL-35106] - crypto: qat - avoid division by zero (Vladis Dronov) [RHEL-35106] - crypto: qat - resolve race condition during AER recovery (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - use kcalloc_node() instead of kzalloc_node() (Vladis Dronov) [RHEL-35106] - [rt] Enable CONFIG_DRM_MGAG200_DISABLE_WRITECOMBINE (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Add an option to disable Write-Combine (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Fix caching setup for remapped video memory (Jocelyn Falempe) [RHEL-36172] - Revert "drm/mgag200: Add a workaround for low-latency" (Jocelyn Falempe) [RHEL-36172] - mptcp: fix data re-injection from stale subflow (Davide Caratti) [RHEL-33133] {CVE-2024-26826} - ipv6: sr: fix incorrect unregister order (Hangbin Liu) [RHEL-31730] - ipv6: sr: fix possible use-after-free and null-ptr-deref (Hangbin Liu) [RHEL-31730] {CVE-2024-26735} - net/bnx2x: Prevent access to a freed page in page_pool (Michal Schmidt) [RHEL-14195 RHEL-33243] {CVE-2024-26859} - bnx2x: new flag for track HW resource allocation (Michal Schmidt) [RHEL-14195 RHEL-33243] - bnx2x: fix page fault following EEH recovery (Michal Schmidt) [RHEL-14195 RHEL-33243] - x86: KVM: SVM: always update the x2avic msr interception (Maxim Levitsky) [RHEL-15495] {CVE-2023-5090} - EDAC/thunderx: Fix possible out-of-bounds string access (Aristeu Rozanski) [RHEL-26573] {CVE-2023-52464} - [rt] build kernel-rt-4.18.0-553.7.1.rt7.348.el8_10 [RHEL-34640] - net: qcom/emac: fix UAF in emac_remove (Ken Cox) [RHEL-37834] {CVE-2021-47311} - perf/core: Bail out early if the request AUX area is out of bound (Michael Petlan) [RHEL-38268] {CVE-2023-52835} - crypto: pcrypt - Fix hungtask for PADATA_RESET (Herbert Xu) [RHEL-38171] {CVE-2023-52813} - drm/amdgpu: fix use-after-free bug (Jocelyn Falempe) [RHEL-31240] {CVE-2024-26656} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash (Ivan Vecera) [RHEL-37008] {CVE-2024-35854} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update (Ivan Vecera) [RHEL-37004] {CVE-2024-35855} - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (Ivan Vecera) [RHEL-37012] {CVE-2024-35853} - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work (Ivan Vecera) [RHEL-37016] {CVE-2024-35852} - mlxsw: spectrum_acl_tcam: Fix warning during rehash (Ivan Vecera) [RHEL-37480] {CVE-2024-36007} - can: peak_pci: peak_pci_remove(): fix UAF (Jose Ignacio Tornos Martinez) [RHEL-38419] {CVE-2021-47456} - usbnet: fix error return code in usbnet_probe() (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - usbnet: sanity check for maxpacket (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - net/mlx5e: fix a double-free in arfs_create_groups (Kamal Heib) [RHEL-36920] {CVE-2024-35835} - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds (Jose Ignacio Tornos Martinez) [RHEL-38220] {CVE-2023-52878} - net: cdc_eem: fix tx fixup skb leak (Jose Ignacio Tornos Martinez) [RHEL-38080] {CVE-2021-47236} - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Jose Ignacio Tornos Martinez) [RHEL-38113] {CVE-2023-52703} - usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() (Desnes Nunes) [RHEL-38248] {CVE-2023-52877} - usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (Desnes Nunes) [RHEL-38240] {CVE-2023-52781} - gro: fix ownership transfer (Xin Long) [RHEL-37226] {CVE-2024-35890} - tipc: fix kernel warning when sending SYN message (Xin Long) [RHEL-38109] {CVE-2023-52700} - erspan: make sure erspan_base_hdr is present in skb->head (Xin Long) [RHEL-37230] {CVE-2024-35888} - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() (Bryan Gurney) [RHEL-17366] - scsi: mpi3mr: Sanitise num_phys (Bryan Gurney) [RHEL-17366] - netfilter: nf_tables: use timestamp to check for set element timeout (Phil Sutter) [RHEL-38023] {CVE-2024-27397} - net/ipv6: SKB symmetric hash should incorporate transport ports (Sabrina Dubroca) [RHEL-32061] - crypto: s390/aes - Fix buffer overread in CTR mode (Herbert Xu) [RHEL-37089] {CVE-2023-52669} - net: Save and restore msg_namelen in sock_sendmsg (Jamie Bainbridge) [RHEL-35893] - net: prevent address rewrite in kernel_bind() (Jamie Bainbridge) [RHEL-35893] - net: prevent rewrite of msg_name in sock_sendmsg() (Jamie Bainbridge) [RHEL-35893] - net: replace calls to sock->ops->connect() with kernel_connect() (Jamie Bainbridge) [RHEL-35893] - net: Avoid address overwrite in kernel_connect (Jamie Bainbridge) [RHEL-35893] - wifi: iwlwifi: dbg-tlv: ensure NUL termination (Jose Ignacio Tornos Martinez) [RHEL-37026] {CVE-2024-35845} - wifi: mac80211: fix potential sta-link leak (Jose Ignacio Tornos Martinez) [RHEL-36916] {CVE-2024-35838} - wifi: nl80211: reject iftype change with mesh ID change (Jose Ignacio Tornos Martinez) [RHEL-36884] {CVE-2024-27410} - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (Jose Ignacio Tornos Martinez) [RHEL-36807] {CVE-2024-35789} - Bluetooth: Avoid potential use-after-free in hci_error_reset (David Marlin) [RHEL-31826] {CVE-2024-26801} - tls: disable async encrypt/decrypt (Sabrina Dubroca) [RHEL-26362 RHEL-26409 RHEL-26420] {CVE-2024-26585 CVE-2024-26583 CVE-2024-26584} - Squashfs: check the inode number is not the invalid value of zero (Phillip Lougher) [RHEL-35096] {CVE-2024-26982} - ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/msg.c: update and document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/sem.c: document and update memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: update/document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: remove duplicated code (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (Kamal Heib) [RHEL-30582] {CVE-2023-52626} - Revert "ACPI: bus: Rework system-level device notification handling" (Prarit Bhargava) [RHEL-21486] - hwrng: core - Fix page fault dead lock on mmap-ed hwrng (Prarit Bhargava) [RHEL-29485] {CVE-2023-52615} - [rt] build kernel-rt-4.18.0-553.6.1.rt7.347.el8_10 [RHEL-34640] - cxgb4: Properly lock TX queue for the selftest. (John B. Wyatt IV) [RHEL-8779] - powerpc/powernv: Add a null pointer check in opal_event_init() (Mamatha Inamdar) [RHEL-37058] {CVE-2023-52686} - crypto: rsa - add a check for allocation failure (Vladis Dronov) [RHEL-35361] - crypto: rsa - allow only odd e and restrict value in FIPS mode (Vladis Dronov) [RHEL-35361] - KEYS: use kfree_sensitive with key (Vladis Dronov) [RHEL-35361] - lib/mpi: Extend the MPI library (only mpi_*_bit() part) (Vladis Dronov) [RHEL-35361] - net: ip_tunnel: prevent perpetual headroom growth (Felix Maurer) [RHEL-31814] {CVE-2024-26804} - s390/cpum_cf: make crypto counters upward compatible across machine types (Tobias Huschle) [RHEL-36048] - RDMA/mlx5: Fix fortify source warning while accessing Eth segment (Kamal Heib) [RHEL-33162] {CVE-2024-26907} - ovl: fix leaked dentry (Miklos Szeredi) [RHEL-27306] {CVE-2021-46972} - x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - x86/mm/vsyscall: Consider vsyscall page part of user address space (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - x86/mm: Add vsyscall address helper (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - mm/swap: fix race when skipping swapcache (Rafael Aquini) [RHEL-31644] {CVE-2024-26759} - swap: fix do_swap_page() race with swapoff (Rafael Aquini) [RHEL-31644] {CVE-2024-26759} - mm/swapfile: use percpu_ref to serialize against concurrent swapoff (Rafael Aquini) [RHEL-31644] {CVE-2024-26759} - mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions() (Rafael Aquini) [RHEL-29294] {CVE-2023-52560} - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr (Jiri Benc) [RHEL-29783] - block: null_blk: Fix handling of fake timeout request (Ming Lei) [RHEL-8130] - null_blk: fix poll request timeout handling (Ming Lei) [RHEL-8130] - block: null_blk: end timed out poll request (Ming Lei) [RHEL-8130] - block: null_blk: only set set->nr_maps as 3 if active poll_queues is > 0 (Ming Lei) [RHEL-8130] - null_blk: allow zero poll queues (Ming Lei) [RHEL-8130] - null_blk: Fix handling of submit_queues and poll_queues attributes (Ming Lei) [RHEL-8130] - null_blk: poll queue support (Ming Lei) [RHEL-8130] - null_blk: fix command timeout completion handling (Ming Lei) [RHEL-8130] - platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (Prarit Bhargava) [RHEL-27790] {CVE-2021-47073} - Bluetooth: avoid memcmp() out of bounds warning (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: hci_event: Fix coding style (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: hci_event: Fix using memcmp when comparing keys (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: Reject connection with the device which has same BD_ADDR (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: hci_event: Ignore NULL link key (David Marlin) [RHEL-3017] {CVE-2020-26555} - ppp_async: limit MRU to 64K (Guillaume Nault) [RHEL-31353] {CVE-2024-26675} - powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (Mamatha Inamdar) [RHEL-37078] {CVE-2023-52675} - tcp: do not accept ACK of bytes we never sent (Xin Long) [RHEL-21952] - [rt] build kernel-rt-4.18.0-553.5.1.rt7.346.el8_10 [RHEL-34640] - tools/power/turbostat: Fix uncore frequency file string (David Arcari) [RHEL-29238] - tools/power turbostat: Expand probe_intel_uncore_frequency() (David Arcari) [RHEL-29238] - uio: Fix use-after-free in uio_open (Ricardo Robaina) [RHEL-26232] {CVE-2023-52439} - net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (Ken Cox) [RHEL-27316] {CVE-2021-47013} - keys: Fix linking a duplicate key to a keyring's assoc_array (David Howells) [RHEL-30772] - keys: Hoist locking out of __key_link_begin() (David Howells) [RHEL-30772] - keys: Break bits out of key_unlink() (David Howells) [RHEL-30772] - keys: Change keyring_serialise_link_sem to a mutex (David Howells) [RHEL-30772] - wifi: brcm80211: handle pmk_op allocation failure (Jose Ignacio Tornos Martinez) [RHEL-35150] {CVE-2024-27048} - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work (Jose Ignacio Tornos Martinez) [RHEL-35140] {CVE-2024-27052} - wifi: iwlwifi: mvm: ensure offloading TID queue exists (Jose Ignacio Tornos Martinez) [RHEL-35130] {CVE-2024-27056} - wifi: mt76: mt7921e: fix use-after-free in free_irq() (Jose Ignacio Tornos Martinez) [RHEL-34866] {CVE-2024-26892} - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete (Jose Ignacio Tornos Martinez) [RHEL-34189] {CVE-2024-26897} - wifi: iwlwifi: mvm: fix a crash when we run out of stations (Jose Ignacio Tornos Martinez) [RHEL-31547] {CVE-2024-26693} - wifi: iwlwifi: fix double-free bug (Jose Ignacio Tornos Martinez) [RHEL-31543] {CVE-2024-26694} - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (Jose Ignacio Tornos Martinez) [RHEL-29089] {CVE-2023-52594} - wifi: rt2x00: restart beacon queue when hardware reset (Jose Ignacio Tornos Martinez) [RHEL-29093] {CVE-2023-52595} - wifi: iwlwifi: fix a memory corruption (Jose Ignacio Tornos Martinez) [RHEL-28903] {CVE-2024-26610} - [rt] build kernel-rt-4.18.0-553.4.1.rt7.345.el8_10 [RHEL-34640] - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117] - net/mlx5e: Prevent deadlock while disabling aRFS (Kamal Heib) [RHEL-35041] {CVE-2024-27014} - x86/tsc: Defer marking TSC unstable to a worker (Wander Lairson Costa) [RHEL-32676] - x86/smpboot: Make TSC synchronization function call based (Wander Lairson Costa) [RHEL-32676] - net: usb: fix possible use-after-free in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - net: usb: fix memory leak in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - [rt] build kernel-rt-4.18.0-552.3.1.rt7.344.el8_10 [RHEL-34640] - netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (Phil Sutter) [RHEL-30076] {CVE-2024-26643} - netfilter: nf_tables: disallow anonymous set with timeout flag (Phil Sutter) [RHEL-30080] {CVE-2024-26642} - selftests/bpf: Fix pyperf180 compilation failure with clang18 (Artem Savkov) [RHEL-35576] - md/raid5: fix atomicity violation in raid5_cache_count (Nigel Croxon) [RHEL-27930] {CVE-2024-23307} - usb: ulpi: Fix debugfs directory leak (Desnes Nunes) [RHEL-33287] {CVE-2024-26919} - powerpc/pseries: Fix potential memleak in papr_get_attr() (Mamatha Inamdar) [RHEL-35213] {CVE-2022-48669} - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (Desnes Nunes) [RHEL-35122] {CVE-2024-27059} - NFSv4: fairly test all delegations on a SEQ4_ revocation (Benjamin Coddington) [RHEL-34912] - USB: core: Fix deadlock in usb_deauthorize_interface() (Desnes Nunes) [RHEL-35002] {CVE-2024-26934} - usb: xhci: Add error handling in xhci_map_urb_for_dma (Desnes Nunes) [RHEL-34958] {CVE-2024-26964} - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (Ewan D. Milne) [RHEL-35076] {CVE-2024-26993} - xhci: handle isoc Babble and Buffer Overrun events properly (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - xhci: process isoc TD properly when there was a transaction error mid TD. (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - USB: core: Fix deadlock in port "disable" sysfs attribute (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - USB: core: Add hub_get() and hub_put() routines (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - netfilter: ipset: Missing gc cancellations fixed (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix performance regression in swap operation (Phil Sutter) [RHEL-30521] - netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test (Phil Sutter) [RHEL-30521] - x86/apic/x2apic: Fix a NULL pointer deref when handling a dying cpu (David Arcari) [RHEL-32516] - x86/coco: Disable 32-bit emulation by default on TDX and SEV (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Make IA32_EMULATION boot time configurable (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/elf: Make loading of 32bit processes depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Rename ignore_sysret() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/cpu: Don't write CSTAR MSR on Intel CPUs (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Introduce ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - [rt] build kernel-rt-4.18.0-552.2.1.rt7.343.el8_10 [RHEL-34640] - s390/ptrace: handle setting of fpc register correctly (Tobias Huschle) [RHEL-29106] {CVE-2023-52598} - net/smc: fix illegal rmb_desc access in SMC-D connection dump (Tobias Huschle) [RHEL-27746] {CVE-2024-26615} - wifi: mac80211: fix race condition on enabling fast-xmit (Jose Ignacio Tornos Martinez) [RHEL-31664] {CVE-2024-26779} - powerpc/fadump: make is_kdump_kernel() return false when fadump is active (Mamatha Inamdar) [RHEL-24401] - vmcore: remove dependency with is_kdump_kernel() for exporting vmcore (Mamatha Inamdar) [RHEL-24401] - mtd: require write permissions for locking and badblock ioctls (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - mtd: properly check all write ioctls for permissions (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - pid: take a reference when initializing `cad_pid` (Waiman Long) [RHEL-29420] {CVE-2021-47118} - i2c: i801: Don't generate an interrupt on bus reset (Prarit Bhargava) [RHEL-30325] {CVE-2021-47153} - RDMA/srpt: Do not register event handler until srpt device is fully setup (Kamal Heib) [RHEL-33224] {CVE-2024-26872} - ceph: switch to corrected encoding of max_xattr_size in mdsmap (Xiubo Li) [RHEL-26723] - ceph: switch to use cap_delay_lock for the unlink delay list (Xiubo Li) [RHEL-32870] - ceph: pass ino# instead of old_dentry if it's disconnected (Xiubo Li) [RHEL-32870] - fat: fix uninitialized field in nostale filehandles (Andrey Albershteyn) [RHEL-33186 RHEL-35108] {CVE-2024-26973} - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (Andrey Albershteyn) [RHEL-33186] {CVE-2024-26901} - idpf: limit the support to GCP only (Michal Schmidt) [RHEL-15652] - redhat/configs: enable CONFIG_IDPF (Michal Schmidt) [RHEL-15652] - idpf: remove the use of ETHTOOL_RING_USE_TCP_DATA_SPLIT (Michal Schmidt) [RHEL-15652] - idpf: workaround for unavailable skb page recycling (Michal Schmidt) [RHEL-15652] - idpf: always allocate a full page (Michal Schmidt) [RHEL-15652] - idpf: remove page pool stats code (Michal Schmidt) [RHEL-15652] - idpf: add minimal macros for __free(kfree) to work (Michal Schmidt) [RHEL-15652] - idpf: fixup include paths for RHEL 8 (Michal Schmidt) [RHEL-15652] - idpf: fix kernel panic on unknown packet types (Michal Schmidt) [RHEL-15652] - idpf: disable local BH when scheduling napi for marker packets (Michal Schmidt) [RHEL-15652] - idpf: remove dealloc vector msg err in idpf_intr_rel (Michal Schmidt) [RHEL-15652] - idpf: fix minor controlq issues (Michal Schmidt) [RHEL-15652] - idpf: prevent deinit uninitialized virtchnl core (Michal Schmidt) [RHEL-15652] - idpf: cleanup virtchnl cruft (Michal Schmidt) [RHEL-15652] - idpf: refactor idpf_recv_mb_msg (Michal Schmidt) [RHEL-15652] - idpf: add async_handler for MAC filter messages (Michal Schmidt) [RHEL-15652] - idpf: refactor remaining virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor queue related virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor vport virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: implement virtchnl transaction manager (Michal Schmidt) [RHEL-15652] - idpf: add idpf_virtchnl.h (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler padding in virtchnl2_ptype struct (Michal Schmidt) [RHEL-15652] - idpf: distinguish vports by the dev_port attribute (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler introduced padding in virtchnl2_rss_key struct (Michal Schmidt) [RHEL-15652] - idpf: fix corrupted frames and skb leaks in singleq mode (Michal Schmidt) [RHEL-15652] - idpf: refactor some missing field get/prep conversions (Michal Schmidt) [RHEL-15652] - idpf: add get/set for Ethtool's header split ringparam (Michal Schmidt) [RHEL-15652] - idpf: fix potential use-after-free in idpf_tso() (Michal Schmidt) [RHEL-15652] - idpf: cancel mailbox work in error path (Michal Schmidt) [RHEL-15652] - idpf: set scheduling mode for completion queue (Michal Schmidt) [RHEL-15652] - idpf: add SRIOV support and other ndo_ops (Michal Schmidt) [RHEL-15652] - idpf: add ethtool callbacks (Michal Schmidt) [RHEL-15652] - idpf: add singleq start_xmit and napi poll (Michal Schmidt) [RHEL-15652] - idpf: add RX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add TX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add splitq start_xmit (Michal Schmidt) [RHEL-15652] - idpf: initialize interrupts and enable vport (Michal Schmidt) [RHEL-15652] - idpf: configure resources for RX queues (Michal Schmidt) [RHEL-15652] - idpf: configure resources for TX queues (Michal Schmidt) [RHEL-15652] - idpf: add ptypes and MAC filter support (Michal Schmidt) [RHEL-15652] - idpf: add create vport and netdev configuration (Michal Schmidt) [RHEL-15652] - idpf: add core init and interrupt request (Michal Schmidt) [RHEL-15652] - idpf: add controlq init and reset checks (Michal Schmidt) [RHEL-15652] - idpf: add module register and probe functionality (Michal Schmidt) [RHEL-15652] - virtchnl: add virtchnl version 2 ops (Michal Schmidt) [RHEL-15652] - net: netdev_queue: netdev_txq_completed_mb(): fix wake condition (Michal Schmidt) [RHEL-15652] - net: piggy back on the memory barrier in bql when waking queues (Michal Schmidt) [RHEL-15652] - net: provide macros for commonly copied lockless queue stop/wake code (Michal Schmidt) [RHEL-15652] - [rt] build kernel-rt-4.18.0-552.1.1.rt7.342.el8_10 [RHEL-34640] - build: Update RTBZ for 8.10 z-stream builds (Denys Vlasenko) - redhat: set DIST to el8_10 and ZSTREAM to yes for 8.10 (Denys Vlasenko) - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (Prarit Bhargava) [RHEL-32590] {CVE-2021-47185} - net: mana: Fix Rx DMA datasize and skb_over_panic (Cathy Avery) [RHEL-32579] - RDMA/srpt: Support specifying the srpt_service_guid parameter (Kamal Heib) [RHEL-31710] {CVE-2024-26744} - RDMA/qedr: Fix qedr_create_user_qp error flow (Kamal Heib) [RHEL-31714] {CVE-2024-26743} - hwmon: (coretemp) Fix out-of-bounds memory access (David Arcari) [RHEL-31305] {CVE-2024-26664} - RDMA/irdma: Fix KASAN issue with tasklet (Kamal Heib) [RHEL-15776] - net: bridge: use DEV_STATS_INC() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: Fix unwanted sign extension in netdev_stats_to_stats64() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: add atomic_long_t to net_device_stats fields (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net/sched: act_ct: fix skb leak and crash on ooo frags (Xin Long) [RHEL-29467] {CVE-2023-52610} - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Jose Ignacio Tornos Martinez) [RHEL-28015] {CVE-2023-52528} - RDMA/core: Fix uninit-value access in ib_get_eth_speed() (Kamal Heib) [RHEL-30130] - RDMA/core: Get IB width and speed from netdev (Kamal Heib) [RHEL-30130] - cpufreq: intel_pstate: Add Emerald Rapids support in no-HWP mode (Prarit Bhargava) [RHEL-29444] - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add (Mamatha Inamdar) [RHEL-29118] {CVE-2023-52607} - powerpc/lib: Validate size for vector operations (Mamatha Inamdar) [RHEL-29114] {CVE-2023-52606} - usb: hub: Guard against accesses to uninitialized BOS descriptors (Desnes Nunes) [RHEL-28986] {CVE-2023-52477} - media: uvcvideo: Fix OOB read (Desnes Nunes) [RHEL-27940] {CVE-2023-52565} - media: pvrusb2: fix use after free on context disconnection (Desnes Nunes) [RHEL-26498] {CVE-2023-52445} - i2c: i801: Fix block process call transactions (Prarit Bhargava) [RHEL-26478] {CVE-2024-26593} - overlay: disable EVM (Coiby Xu) [RHEL-19863] - evm: add support to disable EVM on unsupported filesystems (Coiby Xu) [RHEL-19863] - evm: don't copy up 'security.evm' xattr (Coiby Xu) [RHEL-19863] - net: ena: Remove ena_select_queue (Kamal Heib) [RHEL-14286] - media: dvbdev: Fix memory leak in dvb_media_device_free() (Prarit Bhargava) [RHEL-27254] {CVE-2020-36777} - gfs2: Fix invalid metadata access in punch_hole (Andrew Price) [RHEL-28784] - i2c: Fix a potential use after free (Prarit Bhargava) [RHEL-26849] {CVE-2019-25162} - i2c: validate user data in compat ioctl (Prarit Bhargava) [RHEL-27022] {CVE-2021-46934} - platform/x86: think-lmi: Fix reference leak (Prarit Bhargava) [RHEL-28030] {CVE-2023-52520} - vhost: use kzalloc() instead of kmalloc() followed by memset() (Jon Maloy) [RHEL-21505] {CVE-2024-0340} - RDMA/siw: Fix connection failure handling (Kamal Heib) [RHEL-28042] {CVE-2023-52513} - vt: fix memory overlapping when deleting chars in the buffer (Waiman Long) [RHEL-27778 RHEL-27779] {CVE-2022-48627} - x86/fpu: Stop relying on userspace for info to fault in xsave buffer (Steve Best) [RHEL-26669] {CVE-2024-26603} - mptcp: fix double-free on socket dismantle (Davide Caratti) [RHEL-22773] {CVE-2024-26782} - crypto: akcipher - Disable signing and decryption (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: akcipher - default implementations for request callbacks (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: testmgr - split akcipher tests by a key type (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - workqueue: Warn when a rescuer could not be created (Waiman Long) [RHEL-22136] - RDMA/cma: Avoid GID lookups on iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/cma: Deduplicate error flow in cma_validate_port() (Benjamin Coddington) [RHEL-12456] - RDMA/core: Set gid_attr.ndev for iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/siw: Fabricate a GID on tun and loopback devices (Benjamin Coddington) [RHEL-12456] - eventpoll: fix missing wakeup for ovflist in ep_poll_callback (Luis Claudio R. Goncalves) [RHEL-23022] - [rt] build kernel-rt-4.18.0-552.rt7.341.el8 [RHEL-5332] - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248] - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248] - [rt] build kernel-rt-4.18.0-551.rt7.340.el8 [RHEL-5332] - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742} - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992] - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825} - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237] - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724} - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513} - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921] - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921] - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921] - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921] - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921] - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774] - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660] - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660] - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199] - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539} - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825} - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237] - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724} - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513} - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921] - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921] - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921] - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921] - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921] - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285} - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993} - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396] - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396] - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396] - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396] - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355] - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355] - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355] - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355] - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355] - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355] - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240} - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek) - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963] - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171] - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171] - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226] - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226] - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744] - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744] - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744] - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744] - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew) [RHEL-129945] - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774] - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660] - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660] - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199] - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539} - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825} - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237] - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724} - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513} - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921] - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921] - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921] - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921] - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921] - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301} - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933} - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051} - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449] - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096} - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285} - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993} - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396] - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396] - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396] - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396] - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355] - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355] - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355] - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355] - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355] - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355] - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240} - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek) - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963] - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171] - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171] - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226] - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226] - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744] - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744] - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744] - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744] - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew) [RHEL-129945] - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774] - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660] - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660] - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199] - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539} - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - Bluetooth: hci_event: call disconnect callback before deleting conn (CKI Backport Bot) [RHEL-137039] {CVE-2023-53673} - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CKI Backport Bot) [RHEL-134423] {CVE-2025-40277} - xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 (John J Coleman) [RHEL-111354] - xen: Fix x86 sched_clock() interface for xen (John J Coleman) [RHEL-111354] - x86/xen/time: Output xen sched_clock time from 0 (John J Coleman) [RHEL-111354] - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Olga Kornievskaia) [RHEL-132819] - vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139273] {CVE-2025-40248} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ignore ndlp rport mismatch in dev_loss_tmo callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Modify handling of ADISC based on ndlp state and RPI registration (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Delete NLP_TARGET_REMOVE flag due to obsolete usage (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo callback (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Check devloss callbk done flag for potential stale NDLP ptrs (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kref imbalance on fabric ndlps from dev_loss_tmo handler (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Update PRLO handling in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Add condition to delete ndlp object after sending BLS_RJT to an ABTS (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove NLP_RCV_PLOGI early return during RSCN processing for ndlps (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Allow lpfc_plogi_confirm_nport() logic to execute for Fabric nodes (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix list_entry null check warning in lpfc_cmpl_els_plogi() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix possible file string name overflow when updating firmware (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Validate ELS LS_ACC completion payload (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove extra ndlp kref decrement in FLOGI cmpl for loop topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Revise NPIV ELS unsol rcv cmpl logic to drop ndlp based on nlp_state (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix double free in lpfc_cmpl_els_logo_acc() caused by lpfc_nlp_not_used() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Move scsi_host_template outside dynamically allocated/freed phba (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fill in missing ndlp kref puts in error paths (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login (Ewan D. Milne) [RHEL-32324] - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301} - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933} - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051} - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449] - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096} - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285} - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993} - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396] - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396] - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396] - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396] - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355] - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355] - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355] - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355] - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355] - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355] - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240} - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek) - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963] - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171] - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171] - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226] - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226] - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744] - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744] - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744] - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744] - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew) [RHEL-129945] - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117] - [rt] build kernel-rt-4.18.0-552.rt7.341.el8 [RHEL-5332] - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248] - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248] - [rt] build kernel-rt-4.18.0-551.rt7.340.el8 [RHEL-5332] - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742} - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992] - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992] - [rt] build kernel-rt-4.18.0-550.rt7.339.el8 [RHEL-5332] - mm/sparsemem: fix race in accessing memory_section->usage (Waiman Long) [RHEL-28875 RHEL-28876] {CVE-2023-52489} - mm: use __pfn_to_section() instead of open coding it (Waiman Long) [RHEL-28875] {CVE-2023-52489} - [rt] build kernel-rt-4.18.0-549.rt7.338.el8 [RHEL-5332] - dm-integrity: align the outgoing bio in integrity_recheck (Benjamin Marzinski) [RHEL-29678] - dm-integrity: fix a memory leak when rechecking the data (Benjamin Marzinski) [RHEL-29678] - RDMA/mana_ib: Add CQ interrupt support for RAW QP (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: query device capabilities (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: register RDMA device with GDMA (Maxim Levitsky) [RHEL-23934] - net: mana: add msix index sharing between EQs (Maxim Levitsky) [RHEL-23934] - net: mana: Fix spelling mistake "enforecement" -> "enforcement" (Maxim Levitsky) [RHEL-23934] - net :mana :Add remaining GDMA stats for MANA to ethtool (Maxim Levitsky) [RHEL-23934] - net: mana: Fix oversized sge0 for GSO packets (Maxim Levitsky) [RHEL-23934] - net: mana: Fix TX CQE error handling (Maxim Levitsky) [RHEL-23934] - net: mana: Add gdma stats to ethtool output for mana (Maxim Levitsky) [RHEL-23934] - net: mana: Fix MANA VF unload when hardware is unresponsive (Maxim Levitsky) [RHEL-23934] - net: mana: Configure hwc timeout from hardware (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (Maxim Levitsky) [RHEL-23934] - [rt] build kernel-rt-4.18.0-548.rt7.337.el8 [RHEL-5332] - gitlab-ci: enable arm64/s390x/ppc64le debug builds (Michael Hofmann) - arm64: Add missing bits of AmpereOne Spectre-BHB mitigation (Mark Salter) [RHEL-29005] - [rt] enable CONFIG_DRM_MGAG200_IOBURST_WORKAROUND (Jocelyn Falempe) [RHEL-13214] - drm/mgag200: Add a workaround for low-latency (Jocelyn Falempe) [RHEL-13214] - [rt] build kernel-rt-4.18.0-547.rt7.336.el8 [RHEL-5332] - x86/efistub: Avoid placing the kernel below LOAD_PHYSICAL_ADDR (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Give up if memory attribute protocol returns an error (Lenny Szubowicz) [RHEL-2505] - x86/boot: Increase section and file alignment to 4k/512 (Lenny Szubowicz) [RHEL-2505] - x86/boot: Split off PE/COFF .data section (Lenny Szubowicz) [RHEL-2505] - x86/boot: Drop PE/COFF .reloc section (Lenny Szubowicz) [RHEL-2505] - x86/boot: Construct PE/COFF .text section from assembler (Lenny Szubowicz) [RHEL-2505] - x86/boot: Derive file size from _edata symbol (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed: Remove, discard, or assert for unwanted sections (Lenny Szubowicz) [RHEL-2505] - x86/boot: Check that there are no run-time relocations (Lenny Szubowicz) [RHEL-2505] - x86/boot: Discard .discard.unreachable for arch/x86/boot/compressed/vmlinux (Lenny Szubowicz) [RHEL-2505] - x86/boot: Define setup size in linker script (Lenny Szubowicz) [RHEL-2505] - x86/boot: Set EFI handover offset directly in header asm (Lenny Szubowicz) [RHEL-2505] - x86/boot: Drop references to startup_64 (Lenny Szubowicz) [RHEL-2505] - x86/boot: Drop redundant code setting the root device (Lenny Szubowicz) [RHEL-2505] - x86/build: Declutter the build output (Lenny Szubowicz) [RHEL-2505] - x86/boot: Omit compression buffer from PE/COFF image memory footprint (Lenny Szubowicz) [RHEL-2505] - x86/boot: Mark global variables as static (Lenny Szubowicz) [RHEL-2505] - efi/x86: Remove extra headroom for setup block (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove the 'bugger off' message (Lenny Szubowicz) [RHEL-2505] - x86/efi: Drop alignment flags from PE section headers (Lenny Szubowicz) [RHEL-2505] - efi: Put Linux specific magic number in the DOS header (Lenny Szubowicz) [RHEL-2505] - efi/x86: Fix the missing KASLR_FLAG bit in boot_params->hdr.loadflags (Lenny Szubowicz) [RHEL-2505] - efi/x86: Avoid physical KASLR on older Dell systems (Lenny Szubowicz) [RHEL-2505] - x86/boot: efistub: Assign global boot_params variable (Lenny Szubowicz) [RHEL-2505] - x86/boot: Rename conflicting 'boot_params' pointer to 'boot_params_ptr' (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Avoid legacy decompressor when doing EFI boot (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Perform SNP feature test while running in the firmware (Lenny Szubowicz) [RHEL-2505] - x86/sev: Do not try to parse for the CC blob on non-AMD hardware (Lenny Szubowicz) [RHEL-2505] - efi/libstub: Add limit argument to efi_random_alloc() (Lenny Szubowicz) [RHEL-2505] - arm64: efi: Limit allocations to 48-bit addressable physical region (Lenny Szubowicz) [RHEL-2505] - efi: libstub: use EFI_LOADER_CODE region when moving the kernel in memory (Lenny Szubowicz) [RHEL-2505] - arm64: efi: kaslr: Fix occasional random alloc (and boot) failure (Lenny Szubowicz) [RHEL-2505] - efi/libstub/random: Increase random alloc granularity (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Factor out kernel decompression and relocation (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Move global symbol references to C code (Lenny Szubowicz) [RHEL-2505] - decompress: Use 8 byte alignment (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Prefer EFI memory attributes protocol over DXE services (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Perform 4/5 level paging switch from the stub (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Merge trampoline cleanup with switching code (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Pass pgtable address to trampoline directly (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Only call the trampoline when changing paging levels (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Call trampoline directly from C code (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Avoid the need for a stack in the 32-bit trampoline (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Use standard calling convention for trampoline (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Call trampoline as a normal function (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Remove .bss/.pgtable from bzImage (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove run-time relocations from .head.text code (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Assign paging related global variables earlier (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Store boot_params pointer in callee save register (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Clear BSS in EFI handover protocol entrypoint (Lenny Szubowicz) [RHEL-2505] - x86/head_64: Store boot_params pointer in callee save register (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Don't rely on upper 32 bits of GPRs being preserved (Lenny Szubowicz) [RHEL-2505] - x86/head/64: Switch to KERNEL_CS as soon as new GDT is installed (Lenny Szubowicz) [RHEL-2505] - efi/libstub: Add memory attribute protocol definitions (Lenny Szubowicz) [RHEL-2505] - efi/x86: libstub: remove unused variable (Lenny Szubowicz) [RHEL-2505] - x86/boot: Robustify calling startup_{32,64}() from the decompressor code (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Simplify and clean up handover entry code (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Branch straight to kernel entry point from C code (Lenny Szubowicz) [RHEL-2505] - efi/x86: Avoid using code32_start (Lenny Szubowicz) [RHEL-2505] - efi/libstub/x86: Use Exit() boot service to exit the stub on errors (Lenny Szubowicz) [RHEL-2505] - efi: x86: Wipe setup_data on pure EFI boot (Lenny Szubowicz) [RHEL-2505] - efi: x86: Fix config name for setting the NX-compatibility flag in the PE header (Lenny Szubowicz) [RHEL-2505] - efi: x86: Set the NX-compatibility flag in the PE header (Lenny Szubowicz) [RHEL-2505] - efi/x86: Add kernel preferred address to PE header (Lenny Szubowicz) [RHEL-2505] - efi/x86: Use symbolic constants in PE header instead of bare numbers (Lenny Szubowicz) [RHEL-2505] - efi/x86: Drop redundant .bss section (Lenny Szubowicz) [RHEL-2505] - efi/x86: add headroom to decompressor BSS to account for setup block (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove run-time relocations from head_{32,64}.S (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed: Fix debug_puthex() parameter type (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Use 32-bit (zero-extended) MOV for z_output_len (Lenny Szubowicz) [RHEL-2505] - x86/boot: Use unsigned comparison for addresses (Lenny Szubowicz) [RHEL-2505] - x86/boot: Micro-optimize GDT loading instructions (Lenny Szubowicz) [RHEL-2505] - x86/boot: GDT limit value should be size - 1 (Lenny Szubowicz) [RHEL-2505] - efi/x86: Remove GDT setup from efi_main (Lenny Szubowicz) [RHEL-2505] - x86/boot: Clear direction and interrupt flags in startup_64 (Lenny Szubowicz) [RHEL-2505] - efi/x86: Don't depend on firmware GDT layout (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove KEEP_SEGMENTS support (Lenny Szubowicz) [RHEL-2505] - x86/boot: Handle malformed SRAT tables during early ACPI parsing (Lenny Szubowicz) [RHEL-2505] - efi/libstub/x86: Use mandatory 16-byte stack alignment in mixed mode (Lenny Szubowicz) [RHEL-2505] - efi/libstub/x86: Avoid globals to store context during mixed mode calls (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Disable paging at mixed mode entry (Lenny Szubowicz) [RHEL-2505] - x86: efi/random: Invoke EFI_RNG_PROTOCOL to seed the UEFI RNG table (Lenny Szubowicz) [RHEL-2505] - x86/asm: Make some functions local (Lenny Szubowicz) [RHEL-2505] - x86/boot: Annotate data appropriately (Lenny Szubowicz) [RHEL-2505] - x86/boot: Annotate local functions (Lenny Szubowicz) [RHEL-2505] - x86/asm: Make more symbols local (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Fix missing initialization in find_trampoline_placement() (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Fix boot on machines with broken E820 table (Lenny Szubowicz) [RHEL-2505] - x86, boot: Remove multiple copy of static function sanitize_boot_params() (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Remove unused variable (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Explain paging_prepare()'s return value (Lenny Szubowicz) [RHEL-2505] - x86/boot: Save several bytes in decompressor (Lenny Szubowicz) [RHEL-2505] - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (Audra Mitchell) [RHEL-20614] {CVE-2024-0841} - net/gve: update check for little-endianness in gve kconfig (Joshua Washington) [RHEL-29030] - [rt] build kernel-rt-4.18.0-546.rt7.335.el8 [RHEL-5332] - sched/membarrier: reduce the ability to hammer on sys_membarrier (Wander Lairson Costa) [RHEL-23430] {CVE-2024-26602} - NFS: Set the stable writes flag when initialising the super block (Benjamin Coddington) [RHEL-25266] - smb: client: fix OOB in receive_encrypted_standard() (Scott Mayhew) [RHEL-21685] {CVE-2024-0565} - scsi: core: Move scsi_host_busy() out of host lock if it is for per-command (Ming Lei) [RHEL-23942] - scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler (Ming Lei) [RHEL-23942] - gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump (Andrew Price) [RHEL-26501] {CVE-2023-52448} - smb: client: fix parsing of SMB3.1.1 POSIX create context (Paulo Alcantara) [RHEL-26241] {CVE-2023-52434} - smb: client: fix potential OOBs in smb2_parse_contexts() (Paulo Alcantara) [RHEL-26241] {CVE-2023-52434} - smb3: Replace smb2pdu 1-element arrays with flex-arrays (Jay Shin) [RHEL-22143] - cifs: Replace remaining 1-element arrays (Jay Shin) [RHEL-22143] - cifs: Convert struct fealist away from 1-element array (Jay Shin) [RHEL-22143] - cifs: remove unneeded 2bytes of padding from smb2 tree connect (Jay Shin) [RHEL-22143] - cifs: Replace zero-length arrays with flexible-array members (Jay Shin) [RHEL-22143] - cifs: Replace a couple of one-element arrays with flexible-array members (Jay Shin) [RHEL-22143] - cifs: fix FILE_BOTH_DIRECTORY_INFO definition (Jay Shin) [RHEL-22143] - nfsd: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - nfs: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - lockd: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - cifs: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - ceph: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - filelock: add a new locks_inode_context accessor function (Jeffrey Layton) [RHEL-27441] - dm-integrity, dm-verity: reduce stack usage for recheck (Benjamin Marzinski) [RHEL-27849] - dm-crypt: recheck the integrity tag after a failure (Benjamin Marzinski) [RHEL-27849] - dm-crypt: don't modify the data when using authenticated encryption (Benjamin Marzinski) [RHEL-27849] - dm-verity: recheck the hash after a failure (Benjamin Marzinski) [RHEL-27849] - dm-integrity: recheck the integrity tag after a failure (Benjamin Marzinski) [RHEL-27849] - [rt] build kernel-rt-4.18.0-545.rt7.334.el8 [RHEL-5332] - tracing/timerlat: Move hrtimer_init to timerlat_fd open() (John Kacur) [RHEL-26667] - tracing/perf: Fix double put of trace event when init fails (Michael Petlan) [RHEL-19537] - ipvlan: Add handling of NETDEV_UP events (Hangbin Liu) [RHEL-19098] - ceph: add ceph_cap_unlink_work to fire check_caps() immediately (Xiubo Li) [RHEL-21760] - ceph: always queue a writeback when revoking the Fb caps (Xiubo Li) [RHEL-21760] - ceph: always check dir caps asynchronously (Xiubo Li) [RHEL-21760] - nfs: fix redundant readdir request after get eof (Benjamin Coddington) [RHEL-7780] - NFSv4.1: fixup use EXCHGID4_FLAG_USE_PNFS_DS for DS server (Scott Mayhew) [RHEL-7994] - NFSv4.1: fix pnfs MDS=DS session trunking (Scott Mayhew) [RHEL-7994] - NFSv4.1: fix zero value filehandle in post open getattr (Scott Mayhew) [RHEL-7994] - NFSv4.1: use EXCHGID4_FLAG_USE_PNFS_DS for DS server (Scott Mayhew) [RHEL-7994] - x86/boot: Ignore NMIs during very early boot (Valentin Schneider) [RHEL-22749] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - vfs: use READ_ONCE() to access ->i_link (Jay Shin) [RHEL-141790] - fold generic_readlink() into its only caller (Jay Shin) [RHEL-141790] - fs/proc: fix uaf in proc_readdir_de() (Pavel Reichl) [RHEL-137093] {CVE-2025-40271} - Backport 'create an empty changelog file when changing its name' (Alexandra Hájková) - mptcp: fix race condition in mptcp_schedule_work() (Paolo Abeni) [RHEL-134443] {CVE-2025-40258} - mptcp: use mptcp_schedule_work instead of open-coding it (Paolo Abeni) [RHEL-134443] - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - tcp: minor optimization in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Kamal Heib) [RHEL-134347] {CVE-2025-38022} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - Bluetooth: hci_event: call disconnect callback before deleting conn (CKI Backport Bot) [RHEL-137039] {CVE-2023-53673} - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CKI Backport Bot) [RHEL-134423] {CVE-2025-40277} - xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 (John J Coleman) [RHEL-111354] - xen: Fix x86 sched_clock() interface for xen (John J Coleman) [RHEL-111354] - x86/xen/time: Output xen sched_clock time from 0 (John J Coleman) [RHEL-111354] - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Olga Kornievskaia) [RHEL-132819] - vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139273] {CVE-2025-40248} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ignore ndlp rport mismatch in dev_loss_tmo callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Modify handling of ADISC based on ndlp state and RPI registration (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Delete NLP_TARGET_REMOVE flag due to obsolete usage (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo callback (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Check devloss callbk done flag for potential stale NDLP ptrs (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kref imbalance on fabric ndlps from dev_loss_tmo handler (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Update PRLO handling in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Add condition to delete ndlp object after sending BLS_RJT to an ABTS (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove NLP_RCV_PLOGI early return during RSCN processing for ndlps (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Allow lpfc_plogi_confirm_nport() logic to execute for Fabric nodes (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix list_entry null check warning in lpfc_cmpl_els_plogi() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix possible file string name overflow when updating firmware (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Validate ELS LS_ACC completion payload (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove extra ndlp kref decrement in FLOGI cmpl for loop topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Revise NPIV ELS unsol rcv cmpl logic to drop ndlp based on nlp_state (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix double free in lpfc_cmpl_els_logo_acc() caused by lpfc_nlp_not_used() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Move scsi_host_template outside dynamically allocated/freed phba (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fill in missing ndlp kref puts in error paths (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login (Ewan D. Milne) [RHEL-32324] - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301} - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933} - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051} - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449] - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096} - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - vfs: use READ_ONCE() to access ->i_link (Jay Shin) [RHEL-141790] - fold generic_readlink() into its only caller (Jay Shin) [RHEL-141790] - fs/proc: fix uaf in proc_readdir_de() (Pavel Reichl) [RHEL-137093] {CVE-2025-40271} - Backport 'create an empty changelog file when changing its name' (Alexandra Hájková) - mptcp: fix race condition in mptcp_schedule_work() (Paolo Abeni) [RHEL-134443] {CVE-2025-40258} - mptcp: use mptcp_schedule_work instead of open-coding it (Paolo Abeni) [RHEL-134443] - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - tcp: minor optimization in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Kamal Heib) [RHEL-134347] {CVE-2025-38022} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - vfs: use READ_ONCE() to access ->i_link (Jay Shin) [RHEL-141790] - fold generic_readlink() into its only caller (Jay Shin) [RHEL-141790] - fs/proc: fix uaf in proc_readdir_de() (Pavel Reichl) [RHEL-137093] {CVE-2025-40271} - Backport 'create an empty changelog file when changing its name' (Alexandra Hájková) - mptcp: fix race condition in mptcp_schedule_work() (Paolo Abeni) [RHEL-134443] {CVE-2025-40258} - mptcp: use mptcp_schedule_work instead of open-coding it (Paolo Abeni) [RHEL-134443] - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - tcp: minor optimization in tcp_add_backlog() (Guillaume Nault) [RHEL-137976] {CVE-2022-50865} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Kamal Heib) [RHEL-134347] {CVE-2025-38022} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - autofs: use wake_up() instead of wake_up_interruptible(() (Ian Kent) [RHEL-143685] - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Ian Kent) [RHEL-143685] {CVE-2023-54134} - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141709] - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-136693] - audit: merge loops in __audit_inode_child() (Ricardo Robaina) [RHEL-140442] - bridge: mcast: Fix use-after-free during router port configuration (Mohammad Heib) [RHEL-138422] {CVE-2025-38248} - net/sched: Enforce that teql can only be used as root qdisc (CKI Backport Bot) [RHEL-146992] {CVE-2026-23074} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Marc Milgram) [RHEL-137838] {CVE-2025-38129} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143189] {CVE-2025-68800} - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126886] {CVE-2025-40064} - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (Kamal Heib) [RHEL-138396] {CVE-2024-26766} - fbdev: bitblit: bound-check glyph index in bit_putcs* (Jocelyn Falempe) [RHEL-136937] {CVE-2025-40322} - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137591] {CVE-2025-38459} - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138010] {CVE-2025-38415} - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138010] {CVE-2025-38415} - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137362] {CVE-2025-39760} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137058] {CVE-2025-38024} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147261] {CVE-2026-23097} - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-134673] - autofs: use wake_up() instead of wake_up_interruptible(() (Ian Kent) [RHEL-143685] - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Ian Kent) [RHEL-143685] {CVE-2023-54134} - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141709] - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-136693] - audit: merge loops in __audit_inode_child() (Ricardo Robaina) [RHEL-140442] - bridge: mcast: Fix use-after-free during router port configuration (Mohammad Heib) [RHEL-138422] {CVE-2025-38248} - net/sched: Enforce that teql can only be used as root qdisc (CKI Backport Bot) [RHEL-146992] {CVE-2026-23074} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Marc Milgram) [RHEL-137838] {CVE-2025-38129} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143189] {CVE-2025-68800} - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126886] {CVE-2025-40064} - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998} - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683] - audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776] - lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776] - lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776] - lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776] - lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776] - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170} - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135} - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158} - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966] - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966] - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766} - net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966] - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966] - ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966] - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878] - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349} - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403} - sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - macvlan: fix possible UAF in macvlan_forward_source() (Hangbin Liu) [RHEL-144120] {CVE-2026-23001} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-131922] - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount (Jocelyn Falempe) [RHEL-148636] - audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd references (Waiman Long) [RHEL-146026] - fs: Add a pool of extra fs->pwd references to fs_struct (Waiman Long) [RHEL-146026] - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143535] {CVE-2025-71085} - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147261] {CVE-2026-23097} - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-134673] - autofs: use wake_up() instead of wake_up_interruptible(() (Ian Kent) [RHEL-143685] - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Ian Kent) [RHEL-143685] {CVE-2023-54134} - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141709] - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-136693] - audit: merge loops in __audit_inode_child() (Ricardo Robaina) [RHEL-140442] - bridge: mcast: Fix use-after-free during router port configuration (Mohammad Heib) [RHEL-138422] {CVE-2025-38248} - net/sched: Enforce that teql can only be used as root qdisc (CKI Backport Bot) [RHEL-146992] {CVE-2026-23074} - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Marc Milgram) [RHEL-137838] {CVE-2025-38129} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143189] {CVE-2025-68800} - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126886] {CVE-2025-40064} - s390/ipl: Clear SBP flag when bootprog is set (Mete Durlu) [RHEL-145334] - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Consolidate code for aborting connections (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Fix printing errors if LE Connection times out (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: Move hci_abort_conn to hci_conn.c (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: mgmt: Fix using hci_conn_abort (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_conn: Fix hci_connect_le_sync (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Fix checking for invalid handle on error status (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: hci_event: Ignore multiple conn complete events (David Marlin) [RHEL-137111] {CVE-2023-53762} - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (David Marlin) [RHEL-137111] {CVE-2023-53762} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137678] {CVE-2025-40304} - gfs2: Fix duplicate should_fault_in_pages() call (Andreas Gruenbacher) [RHEL-130505] - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130012] {CVE-2025-40168} E* Wed Feb 04 2026 Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.104.1.rt7.445.el8_10] - Revert "audit: Avoid excessive dput/dget in audit_context setup and reset paths" (Alexandra Hájková) [RHEL-145856] - ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - x86/microcode/AMD: Revert "Backport AMD microcode commits for better microcode loading support" (Waiman Long) [RHEL-155860] - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150398] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150398] - tcp: fix forever orphan socket caused by tcp_abort (Paolo Abeni) [RHEL-146187] - xfs: fix minimum agno handling for xfs alloc modes in RHEL8 (Brian Foster) [RHEL-102464] - xfs: fix uninitialized use of flags variable in xfs_alloc_vextent() (Brian Foster) [RHEL-102464] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82523] - tcp: use this_cpu_read(*X) instead of *this_cpu_ptr(X) (Davide Caratti) [RHEL-82523] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150221] - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150221] {CVE-2026-23209} - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) [RHEL-96016] - s390/kexec: Emit an error message when cmdline is too long (Mete Durlu) [RHEL-144946] - s390/boot: Fix kernel size in bootparm area (Mete Durlu) [RHEL-144946] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-137123] - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-151614] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove useless transaction in evict_linked_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-151614] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-151614] - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146419] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146419] {CVE-2025-38323} - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136288] - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136288] - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136288] - scsi: st: Tighten the page format heuristics with MODE SELECT (John Meneghini) [RHEL-136288] - scsi: st: ERASE does not change tape location (John Meneghini) [RHEL-136288] - scsi: st: Fix array overflow in st_setup() (John Meneghini) [RHEL-136288] - scsi: st: Add sysfs file position_lost_in_reset (John Meneghini) [RHEL-136288] - scsi: st: Modify st.c to use the new scsi_error counters (John Meneghini) [RHEL-136288] - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (John Meneghini) [RHEL-136288] - scsi: st: Restore some drive settings after reset (John Meneghini) [RHEL-136288] - scsi: st: Fix input/output error on empty drive reset (John Meneghini) [RHEL-136288] - smb: client: handle lack of IPC in dfs_cache_refresh() (Paulo Alcantara) [RHEL-138235] - smb: client: allow parsing zero-length AV pairs (Paulo Alcantara) [RHEL-138235] - cifs: reduce warning log level for server not advertising interfaces (Paulo Alcantara) [RHEL-138235] - smb: client: Fix match_session bug preventing session reuse (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of kstrdup() in get_ses_refpath() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy when tree connecting to DFS interlink targets (Paulo Alcantara) [RHEL-138235] - smb: client: don't trust DFSREF_STORAGE_SERVER bit (Paulo Alcantara) [RHEL-138235] - smb: client: don't check for @leaf_fullpath in match_server() (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of TCP_Server_Info::refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: don't retry DFS targets on server shutdown (Paulo Alcantara) [RHEL-138235] - smb: client: fix return value of parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: optimize referral walk on failed link targets (Paulo Alcantara) [RHEL-138235] - smb: client: provide dns_resolve_{unc,name} helpers (Paulo Alcantara) [RHEL-138235] - smb: client: parse DNS domain name from domain= option (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS mount against old servers with NTLMSSP (Paulo Alcantara) [RHEL-138235] - smb: client: parse av pair type 4 in CHALLENGE_MESSAGE (Paulo Alcantara) [RHEL-138235] - smb: client: introduce av_for_each_entry() helper (Paulo Alcantara) [RHEL-138235] - smb: client: fix double free of TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-138235] {CVE-2025-21673} - smb: client: fix potential race in cifs_put_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy message when mounting shares (Paulo Alcantara) [RHEL-138235] - smb: client: don't try following DFS links in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow reconnect when sending ioctl (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of @nlsc param in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow more DFS referrals to be cached (Paulo Alcantara) [RHEL-138235] - smb: client: propagate error from cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS failover in multiuser mounts (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS interlink failover (Paulo Alcantara) [RHEL-138235] - smb: client: improve purging of cached referrals (Paulo Alcantara) [RHEL-138235] - smb: client: avoid unnecessary reconnects when refreshing referrals (Paulo Alcantara) [RHEL-138235] - smb: client: serialise cifs_construct_tcon() with cifs_mount_mutex (Paulo Alcantara) [RHEL-138235] - smb: client: handle DFS tcons in cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: refresh referral without acquiring refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: guarantee refcounted children from parent session (Paulo Alcantara) [RHEL-138235] {CVE-2024-35869} - smb: client: set correct id, uid and cruid for multiuser automounts (Paulo Alcantara) [RHEL-138235] {CVE-2024-26822} - cifs: change tcon status when need_reconnect is set on it (Paulo Alcantara) [RHEL-138235] - smb: client: fix potential NULL deref in parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: fix mount when dns_resolver key is not available (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs code dep in namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs naming in automount code (Paulo Alcantara) [RHEL-138235] - smb: client: rename cifs_dfs_ref.c to namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: ensure to try all targets when finding nested links (Paulo Alcantara) [RHEL-138235] - smb: client: introduce DFS_CACHE_TGT_LIST() (Paulo Alcantara) [RHEL-138235] - smb: client: fix null auth (Paulo Alcantara) [RHEL-138235] - smb: client: fix dfs link mount against w2k8 (Paulo Alcantara) [RHEL-138235] - cifs: fix charset issue in reconnection (Paulo Alcantara) [RHEL-138235] - smb: client: fix missed ses refcounting (Paulo Alcantara) [RHEL-138235] {CVE-2023-54076} - fs/nls: make load_nls() take a const parameter (Paulo Alcantara) [RHEL-138235] - smb: client: remove redundant pointer 'server' (Paulo Alcantara) [RHEL-138235] - smb: client: improve DFS mount check (Paulo Alcantara) [RHEL-138235] - smb: client: fix shared DFS root mounts with different prefixes (Paulo Alcantara) [RHEL-138235] - smb: client: fix parsing of source mount option (Paulo Alcantara) [RHEL-138235] - smb: client: fix warning in cifs_match_super() (Paulo Alcantara) [RHEL-138235] - cifs: fix max_credits implementation (Paulo Alcantara) [RHEL-138235] - cifs: fix sockaddr comparison in iface_cmp (Paulo Alcantara) [RHEL-138235] - cifs: fix status checks in cifs_tree_connect (Paulo Alcantara) [RHEL-138235] - cifs: fix smb1 mount regression (Paulo Alcantara) [RHEL-138235] - cifs: fix sharing of DFS connections (Paulo Alcantara) [RHEL-138235] - cifs: avoid potential races when handling multiple dfs tcons (Paulo Alcantara) [RHEL-138235] - cifs: protect access of TCP_Server_Info::{origin,leaf}_fullpath (Paulo Alcantara) [RHEL-138235] - cifs: avoid dup prefix path in dfs_get_automount_devname() (Paulo Alcantara) [RHEL-138235] - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL (Paulo Alcantara) [RHEL-138235] {CVE-2023-53246} - smb3: fix unusable share after force unmount failure (Paulo Alcantara) [RHEL-138235] - cifs: check only tcon status on tcon related functions (Paulo Alcantara) [RHEL-138235] - cifs: return DFS root session id in DebugData (Paulo Alcantara) [RHEL-138235] - cifs: fix use-after-free bug in refresh_cache_worker() (Paulo Alcantara) [RHEL-138235] {CVE-2023-53052} - cifs: set DFS root session in cifs_get_smb_ses() (Paulo Alcantara) [RHEL-138235] - cifs: remove unused function (Paulo Alcantara) [RHEL-138235] - cifs: remove duplicate code in __refresh_tcon() (Paulo Alcantara) [RHEL-138235] - cifs: remove redundant assignment to the variable match (Paulo Alcantara) [RHEL-138235] - cifs: use origin fullpath for automounts (Paulo Alcantara) [RHEL-138235] - cifs: fix source pathname comparison of dfs supers (Paulo Alcantara) [RHEL-138235] - cifs: fix confusing debug message (Paulo Alcantara) [RHEL-138235] - cifs: don't block in dfs_cache_noreq_update_tgthint() (Paulo Alcantara) [RHEL-138235] - cifs: refresh root referrals (Paulo Alcantara) [RHEL-138235] - cifs: fix refresh of cached referrals (Paulo Alcantara) [RHEL-138235] - cifs: share dfs connections and supers (Paulo Alcantara) [RHEL-138235] - cifs: split out ses and tcon retrieval from mount_get_conns() (Paulo Alcantara) [RHEL-138235] - cifs: set resolved ip in sockaddr (Paulo Alcantara) [RHEL-138235] - cifs: remove unused smb3_fs_context::mount_options (Paulo Alcantara) [RHEL-138235] - cifs: get rid of mount options string parsing (Paulo Alcantara) [RHEL-138235] - cifs: use fs_context for automounts (Paulo Alcantara) [RHEL-138235] - cifs: remove various function description warnings (Paulo Alcantara) [RHEL-138235] - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Select which microcode patch to load (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add more known models to entry sign checking (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Limit Entrysign signature checking to known generations (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use sha256() instead of init/update/final (Waiman Long) [RHEL-132479] - x86/microcode: Fix Entrysign revision check for Zen1/Naples (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Handle the case of no BIOS microcode (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add some forgotten models to the SHA check (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Load only SHA256-checksummed patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add get_patch_level() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Merge early_apply_microcode() into its single callsite (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Have __apply_microcode_amd() return bool (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Flush patch buffer mapping after application (Waiman Long) [RHEL-132479] - x86/mm: Carve out INVLPG inline asm for use by others (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Split load_microcode_amd() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Pay attention to the stepping dynamically (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix a -Wsometimes-uninitialized clang false positive (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use the family,model,stepping encoded in the patch ID (Waiman Long) [RHEL-132479] - x86/microcode/amd: Cache builtin microcode too (Waiman Long) [RHEL-132479] - x86/microcode/amd: Use correct per CPU ucode_cpu_info (Waiman Long) [RHEL-132479] - x86/microcode/amd: Remove X86_32 specific code in early_apply_microcode() & get_builtin_microcode() (Waiman Long) [RHEL-132479] - x86/microcode: Move core specific defines to local header (Waiman Long) [RHEL-132479] - x86/microcode/intel: Rename get_datasize() since its used externally (Waiman Long) [RHEL-132479] - x86/microcode: Make reload_early_microcode() static (Waiman Long) [RHEL-132479] - x86/microcode: Include vendor headers into microcode.h (Waiman Long) [RHEL-132479] - x86/microcode/intel: Move microcode functions out of cpu/intel.c (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Get rid of __find_equiv_id() (Waiman Long) [RHEL-132479] - x86/microcode: Add explicit CPU vendor dependency (Waiman Long) [RHEL-132479] - macvlan: fix possible UAF in macvlan_forward_source() (Hangbin Liu) [RHEL-144120] {CVE-2026-23001} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-131922] - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount (Jocelyn Falempe) [RHEL-148636] - audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd references (Waiman Long) [RHEL-146026] - fs: Add a pool of extra fs->pwd references to fs_struct (Waiman Long) [RHEL-146026] - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143535] {CVE-2025-71085} - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147261] {CVE-2026-23097} - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-134673] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930] - NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242] - pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242] - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242] - NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242] - NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242] - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242] - SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242] - NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242] - SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242] - SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242] - SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242] - SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242] - NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242] - NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419] - nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419] - pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419] - NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419] - NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419] - NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419] - NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419] - NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419] - NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419] - NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419] - NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419] - NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419] - nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419] - nfs: always check dreq->error after a commit (Mike Snitzer) [RHEL-156419] - nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419] - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231} - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942] - x86/microcode/AMD: Revert "Backport AMD microcode commits for better microcode loading support" (Waiman Long) [RHEL-155860] - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150398] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150398] - tcp: fix forever orphan socket caused by tcp_abort (Paolo Abeni) [RHEL-146187] - xfs: fix minimum agno handling for xfs alloc modes in RHEL8 (Brian Foster) [RHEL-102464] - xfs: fix uninitialized use of flags variable in xfs_alloc_vextent() (Brian Foster) [RHEL-102464] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82523] - tcp: use this_cpu_read(*X) instead of *this_cpu_ptr(X) (Davide Caratti) [RHEL-82523] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150221] - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150221] {CVE-2026-23209} - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) [RHEL-96016] - s390/kexec: Emit an error message when cmdline is too long (Mete Durlu) [RHEL-144946] - s390/boot: Fix kernel size in bootparm area (Mete Durlu) [RHEL-144946] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-137123] - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-151614] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove useless transaction in evict_linked_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-151614] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-151614] - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146419] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146419] {CVE-2025-38323} - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136288] - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136288] - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136288] - scsi: st: Tighten the page format heuristics with MODE SELECT (John Meneghini) [RHEL-136288] - scsi: st: ERASE does not change tape location (John Meneghini) [RHEL-136288] - scsi: st: Fix array overflow in st_setup() (John Meneghini) [RHEL-136288] - scsi: st: Add sysfs file position_lost_in_reset (John Meneghini) [RHEL-136288] - scsi: st: Modify st.c to use the new scsi_error counters (John Meneghini) [RHEL-136288] - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (John Meneghini) [RHEL-136288] - scsi: st: Restore some drive settings after reset (John Meneghini) [RHEL-136288] - scsi: st: Fix input/output error on empty drive reset (John Meneghini) [RHEL-136288] - smb: client: handle lack of IPC in dfs_cache_refresh() (Paulo Alcantara) [RHEL-138235] - smb: client: allow parsing zero-length AV pairs (Paulo Alcantara) [RHEL-138235] - cifs: reduce warning log level for server not advertising interfaces (Paulo Alcantara) [RHEL-138235] - smb: client: Fix match_session bug preventing session reuse (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of kstrdup() in get_ses_refpath() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy when tree connecting to DFS interlink targets (Paulo Alcantara) [RHEL-138235] - smb: client: don't trust DFSREF_STORAGE_SERVER bit (Paulo Alcantara) [RHEL-138235] - smb: client: don't check for @leaf_fullpath in match_server() (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of TCP_Server_Info::refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: don't retry DFS targets on server shutdown (Paulo Alcantara) [RHEL-138235] - smb: client: fix return value of parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: optimize referral walk on failed link targets (Paulo Alcantara) [RHEL-138235] - smb: client: provide dns_resolve_{unc,name} helpers (Paulo Alcantara) [RHEL-138235] - smb: client: parse DNS domain name from domain= option (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS mount against old servers with NTLMSSP (Paulo Alcantara) [RHEL-138235] - smb: client: parse av pair type 4 in CHALLENGE_MESSAGE (Paulo Alcantara) [RHEL-138235] - smb: client: introduce av_for_each_entry() helper (Paulo Alcantara) [RHEL-138235] - smb: client: fix double free of TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-138235] {CVE-2025-21673} - smb: client: fix potential race in cifs_put_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix noisy message when mounting shares (Paulo Alcantara) [RHEL-138235] - smb: client: don't try following DFS links in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow reconnect when sending ioctl (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of @nlsc param in cifs_tree_connect() (Paulo Alcantara) [RHEL-138235] - smb: client: allow more DFS referrals to be cached (Paulo Alcantara) [RHEL-138235] - smb: client: propagate error from cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS failover in multiuser mounts (Paulo Alcantara) [RHEL-138235] - smb: client: fix DFS interlink failover (Paulo Alcantara) [RHEL-138235] - smb: client: improve purging of cached referrals (Paulo Alcantara) [RHEL-138235] - smb: client: avoid unnecessary reconnects when refreshing referrals (Paulo Alcantara) [RHEL-138235] - smb: client: serialise cifs_construct_tcon() with cifs_mount_mutex (Paulo Alcantara) [RHEL-138235] - smb: client: handle DFS tcons in cifs_construct_tcon() (Paulo Alcantara) [RHEL-138235] - smb: client: refresh referral without acquiring refpath_lock (Paulo Alcantara) [RHEL-138235] - smb: client: guarantee refcounted children from parent session (Paulo Alcantara) [RHEL-138235] {CVE-2024-35869} - smb: client: set correct id, uid and cruid for multiuser automounts (Paulo Alcantara) [RHEL-138235] {CVE-2024-26822} - cifs: change tcon status when need_reconnect is set on it (Paulo Alcantara) [RHEL-138235] - smb: client: fix potential NULL deref in parse_dfs_referrals() (Paulo Alcantara) [RHEL-138235] - smb: client: fix mount when dns_resolver key is not available (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs code dep in namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: get rid of dfs naming in automount code (Paulo Alcantara) [RHEL-138235] - smb: client: rename cifs_dfs_ref.c to namespace.c (Paulo Alcantara) [RHEL-138235] - smb: client: ensure to try all targets when finding nested links (Paulo Alcantara) [RHEL-138235] - smb: client: introduce DFS_CACHE_TGT_LIST() (Paulo Alcantara) [RHEL-138235] - smb: client: fix null auth (Paulo Alcantara) [RHEL-138235] - smb: client: fix dfs link mount against w2k8 (Paulo Alcantara) [RHEL-138235] - cifs: fix charset issue in reconnection (Paulo Alcantara) [RHEL-138235] - smb: client: fix missed ses refcounting (Paulo Alcantara) [RHEL-138235] {CVE-2023-54076} - fs/nls: make load_nls() take a const parameter (Paulo Alcantara) [RHEL-138235] - smb: client: remove redundant pointer 'server' (Paulo Alcantara) [RHEL-138235] - smb: client: improve DFS mount check (Paulo Alcantara) [RHEL-138235] - smb: client: fix shared DFS root mounts with different prefixes (Paulo Alcantara) [RHEL-138235] - smb: client: fix parsing of source mount option (Paulo Alcantara) [RHEL-138235] - smb: client: fix warning in cifs_match_super() (Paulo Alcantara) [RHEL-138235] - cifs: fix max_credits implementation (Paulo Alcantara) [RHEL-138235] - cifs: fix sockaddr comparison in iface_cmp (Paulo Alcantara) [RHEL-138235] - cifs: fix status checks in cifs_tree_connect (Paulo Alcantara) [RHEL-138235] - cifs: fix smb1 mount regression (Paulo Alcantara) [RHEL-138235] - cifs: fix sharing of DFS connections (Paulo Alcantara) [RHEL-138235] - cifs: avoid potential races when handling multiple dfs tcons (Paulo Alcantara) [RHEL-138235] - cifs: protect access of TCP_Server_Info::{origin,leaf}_fullpath (Paulo Alcantara) [RHEL-138235] - cifs: avoid dup prefix path in dfs_get_automount_devname() (Paulo Alcantara) [RHEL-138235] - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL (Paulo Alcantara) [RHEL-138235] {CVE-2023-53246} - smb3: fix unusable share after force unmount failure (Paulo Alcantara) [RHEL-138235] - cifs: check only tcon status on tcon related functions (Paulo Alcantara) [RHEL-138235] - cifs: return DFS root session id in DebugData (Paulo Alcantara) [RHEL-138235] - cifs: fix use-after-free bug in refresh_cache_worker() (Paulo Alcantara) [RHEL-138235] {CVE-2023-53052} - cifs: set DFS root session in cifs_get_smb_ses() (Paulo Alcantara) [RHEL-138235] - cifs: remove unused function (Paulo Alcantara) [RHEL-138235] - cifs: remove duplicate code in __refresh_tcon() (Paulo Alcantara) [RHEL-138235] - cifs: remove redundant assignment to the variable match (Paulo Alcantara) [RHEL-138235] - cifs: use origin fullpath for automounts (Paulo Alcantara) [RHEL-138235] - cifs: fix source pathname comparison of dfs supers (Paulo Alcantara) [RHEL-138235] - cifs: fix confusing debug message (Paulo Alcantara) [RHEL-138235] - cifs: don't block in dfs_cache_noreq_update_tgthint() (Paulo Alcantara) [RHEL-138235] - cifs: refresh root referrals (Paulo Alcantara) [RHEL-138235] - cifs: fix refresh of cached referrals (Paulo Alcantara) [RHEL-138235] - cifs: share dfs connections and supers (Paulo Alcantara) [RHEL-138235] - cifs: split out ses and tcon retrieval from mount_get_conns() (Paulo Alcantara) [RHEL-138235] - cifs: set resolved ip in sockaddr (Paulo Alcantara) [RHEL-138235] - cifs: remove unused smb3_fs_context::mount_options (Paulo Alcantara) [RHEL-138235] - cifs: get rid of mount options string parsing (Paulo Alcantara) [RHEL-138235] - cifs: use fs_context for automounts (Paulo Alcantara) [RHEL-138235] - cifs: remove various function description warnings (Paulo Alcantara) [RHEL-138235] - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Select which microcode patch to load (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add more known models to entry sign checking (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Limit Entrysign signature checking to known generations (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use sha256() instead of init/update/final (Waiman Long) [RHEL-132479] - x86/microcode: Fix Entrysign revision check for Zen1/Naples (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Handle the case of no BIOS microcode (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add some forgotten models to the SHA check (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Load only SHA256-checksummed patches (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Add get_patch_level() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Merge early_apply_microcode() into its single callsite (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Have __apply_microcode_amd() return bool (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Flush patch buffer mapping after application (Waiman Long) [RHEL-132479] - x86/mm: Carve out INVLPG inline asm for use by others (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Split load_microcode_amd() (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Pay attention to the stepping dynamically (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Fix a -Wsometimes-uninitialized clang false positive (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Use the family,model,stepping encoded in the patch ID (Waiman Long) [RHEL-132479] - x86/microcode/amd: Cache builtin microcode too (Waiman Long) [RHEL-132479] - x86/microcode/amd: Use correct per CPU ucode_cpu_info (Waiman Long) [RHEL-132479] - x86/microcode/amd: Remove X86_32 specific code in early_apply_microcode() & get_builtin_microcode() (Waiman Long) [RHEL-132479] - x86/microcode: Move core specific defines to local header (Waiman Long) [RHEL-132479] - x86/microcode/intel: Rename get_datasize() since its used externally (Waiman Long) [RHEL-132479] - x86/microcode: Make reload_early_microcode() static (Waiman Long) [RHEL-132479] - x86/microcode: Include vendor headers into microcode.h (Waiman Long) [RHEL-132479] - x86/microcode/intel: Move microcode functions out of cpu/intel.c (Waiman Long) [RHEL-132479] - x86/microcode/AMD: Get rid of __find_equiv_id() (Waiman Long) [RHEL-132479] - x86/microcode: Add explicit CPU vendor dependency (Waiman Long) [RHEL-132479] - macvlan: fix possible UAF in macvlan_forward_source() (Hangbin Liu) [RHEL-144120] {CVE-2026-23001} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-131922] - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount (Jocelyn Falempe) [RHEL-148636] - audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd references (Waiman Long) [RHEL-146026] - fs: Add a pool of extra fs->pwd references to fs_struct (Waiman Long) [RHEL-146026] - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143535] {CVE-2025-71085} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930] - NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242] - pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242] - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242] - NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242] - NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242] - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242] - SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242] - NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242] - SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242] - SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242] - SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242] - SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242] - NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242] - NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419] - nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419] - pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419] - NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419] - NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419] - NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419] - NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419] - NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419] - NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419] - NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419] - NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419] - NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419] - nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419] - nfs: always check dreq->error after a commit (Mike Snitzer) [RHEL-156419] - nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419] - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231} - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942] - x86/microcode/AMD: Revert "Backport AMD microcode commits for better microcode loading support" (Waiman Long) [RHEL-155860] - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150398] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150398] - tcp: fix forever orphan socket caused by tcp_abort (Paolo Abeni) [RHEL-146187] - xfs: fix minimum agno handling for xfs alloc modes in RHEL8 (Brian Foster) [RHEL-102464] - xfs: fix uninitialized use of flags variable in xfs_alloc_vextent() (Brian Foster) [RHEL-102464] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82523] - tcp: use this_cpu_read(*X) instead of *this_cpu_ptr(X) (Davide Caratti) [RHEL-82523] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150221] - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150221] {CVE-2026-23209} - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) [RHEL-96016] - s390/kexec: Emit an error message when cmdline is too long (Mete Durlu) [RHEL-144946] - s390/boot: Fix kernel size in bootparm area (Mete Durlu) [RHEL-144946] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-137123] - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-151614] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove useless transaction in evict_linked_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-151614] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-151614] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-151614] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-151614] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-151614] - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146419] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146419] {CVE-2025-38323} - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136288] - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136288] - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136288] - scsi: st: Tighten the page format heuristics with MODE SELECT (John Meneghini) [RHEL-136288] - scsi: st: ERASE does not change tape location (John Meneghini) [RHEL-136288] - scsi: st: Fix array overflow in st_setup() (John Meneghini) [RHEL-136288] - scsi: st: Add sysfs file position_lost_in_reset (John Meneghini) [RHEL-136288] - scsi: st: Modify st.c to use the new scsi_error counters (John Meneghini) [RHEL-136288] - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (John Meneghini) [RHEL-136288] - scsi: st: Restore some drive settings after reset (John Meneghini) [RHEL-136288] - scsi: st: Fix input/output error on empty drive reset (John Meneghini) [RHEL-136288] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - nouveau: fix instmem race condition around ptr stores (Lyude Paul) [RHEL-111846] {CVE-2024-26984} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mete Durlu) [RHEL-157930] - NFSv4/flexfiles: Fix layout merge mirror check. (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Mike Snitzer) [RHEL-157242] - pnfs/flexfiles: retry getting layout segment for reads (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Mike Snitzer) [RHEL-157242] - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Mike Snitzer) [RHEL-157242] - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Record the RPC errors in the I/O tracepoints (Mike Snitzer) [RHEL-157242] - NFSv4/pnfs: Layoutreturn on close must handle fatal networking errors (Mike Snitzer) [RHEL-157242] - NFSv4: Handle fatal ENETDOWN and ENETUNREACH errors (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Report ENETDOWN as a connection error (Mike Snitzer) [RHEL-157242] - pNFS/flexfiles: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Treat ENETUNREACH errors as fatal in containers (Mike Snitzer) [RHEL-157242] - NFS: Add a mount option to make ENETUNREACH errors fatal (Mike Snitzer) [RHEL-157242] - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (Mike Snitzer) [RHEL-157242] - SUNRPC: ECONNRESET might require a rebind (Mike Snitzer) [RHEL-157242] - NFS/pNFS: Set the connect timeout for the pNFS flexfiles driver (Mike Snitzer) [RHEL-157242] - SUNRPC: Don't override connect timeouts in rpc_clnt_add_xprt() (Mike Snitzer) [RHEL-157242] - SUNRPC: Allow specification of TCP client connect timeout at setup (Mike Snitzer) [RHEL-157242] - SUNRPC: Refactor and simplify connect timeout (Mike Snitzer) [RHEL-157242] - SUNRPC: Set the TCP_SYNCNT to match the socket timeout (Mike Snitzer) [RHEL-157242] - NFS: discard NFS_RPC_SWAPFLAGS and RPC_TASK_ROOTCREDS (Mike Snitzer) [RHEL-157242] - NFS: O_DIRECT writes must check and adjust the file length (Mike Snitzer) [RHEL-156419] - nfs: properly protect nfs_direct_req fields (Mike Snitzer) [RHEL-156419] - pNFS: Fix the pnfs block driver's calculation of layoutget size (Mike Snitzer) [RHEL-156419] - NFS: More fixes for nfs_direct_write_reschedule_io() (Mike Snitzer) [RHEL-156419] - NFS: Use the correct commit info in nfs_join_page_group() (Mike Snitzer) [RHEL-156419] - NFS: More O_DIRECT accounting fixes for error paths (Mike Snitzer) [RHEL-156419] - NFS: Fix O_DIRECT locking issues (Mike Snitzer) [RHEL-156419] - NFS: Fix error handling for O_DIRECT write scheduling (Mike Snitzer) [RHEL-156419] - NFS: Fix a potential data corruption (Mike Snitzer) [RHEL-156419] - NFS: Fix a use after free in nfs_direct_join_group() (Mike Snitzer) [RHEL-156419] - NFS: Clean up O_DIRECT request allocation (Mike Snitzer) [RHEL-156419] - NFS: add nfs_page_create and nfs_page_assign_page as backport prereq (Mike Snitzer) [RHEL-156419] - nfs: only issue commit in DIO codepath if we have uncommitted data (Mike Snitzer) [RHEL-156419] - nfs: always check dreq->error after a commit (Mike Snitzer) [RHEL-156419] - nfs: add new nfs_direct_req tracepoint events (Mike Snitzer) [RHEL-156419] - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-153405] {CVE-2025-71238} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153264] {CVE-2026-23231} - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-123942] - xfrm: esp: avoid in-place decrypt on shared skb frags - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - nvme-pci: do not directly handle subsys reset fallout (Maurizio Lombardi) [RHEL-136436] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150417] {CVE-2026-23193} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159219] {CVE-2025-68741} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150125] {CVE-2026-23191} - ALSA: aloop: Introduce a function to get if access is interleaved mode (CKI Backport Bot) [RHEL-150125] {CVE-2026-23191} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772] - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772] - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772] - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772] - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772] - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772] - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709} - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815] - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815] - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815] - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190} - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408} - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684} - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032] - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032] - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032] - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032] - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032] - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032] - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032] - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032] - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032] - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183} - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219] - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219] - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219] - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219] - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219] - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219] - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219] - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347} - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243} - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890] - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890] - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890] - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890] - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890] - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890] - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890] - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167011] {CVE-2026-31402} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-160075] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-160075] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-160075] - KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() (Maxim Levitsky) [RHEL-152657] - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky) [RHEL-152657] - s390/dasd: Copy detected format information to secondary device (Mete Durlu) [RHEL-161532] - s390/dasd: Move quiesce state with pprc swap (Mete Durlu) [RHEL-161532] - s390/dasd: Fix gendisk parent after copy pair swap (Mete Durlu) [RHEL-161532] - redhat: kernel.spec: add missing sound/soc/sof/sof-audio.h to kernel-devel package (Jaroslav Kysela) [RHEL-152417] - s390/virtio_ccw: Fix dma_parm pointer not set up (CKI Backport Bot) [RHEL-148307] - dlm: fix recovery pending middle conversion (Alexander Aring) [RHEL-125538] - dlm: check for undefined release_option values (Alexander Aring) [RHEL-136236] - dlm: handle release_option as unsigned (Alexander Aring) [RHEL-136236] - dlm: handle invalid lockspace member remove (Alexander Aring) [RHEL-136236] - dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: add new configfs entry release_recover for lockspace members (Alexander Aring) [RHEL-136236] - dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace (Alexander Aring) [RHEL-136236] - dlm: use defines for force values in dlm_release_lockspace (Alexander Aring) [RHEL-136236] - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring) [RHEL-136236] - dlm: disallow different configs nodeid storages (Alexander Aring) [RHEL-136236] - dlm: prevent NPD when writing a positive value to event_done (Alexander Aring) [RHEL-136236] {CVE-2025-23131} - dlm: Switch to using wait_event() (Alexander Aring) [RHEL-136236] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613} - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961] - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858} - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392} - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781} - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990} - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772] - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772] - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772] - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772] - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772] - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772] - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709} - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815] - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815] - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815] - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190} - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408} - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684} - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032] - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032] - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032] - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032] - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032] - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032] - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032] - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032] - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032] - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183} - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219] - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219] - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219] - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219] - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219] - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219] - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219] - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347} - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243} - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890] - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890] - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890] - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890] - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890] - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890] - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890] - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174586] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172187] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172187] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172187] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172187] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172187] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172187] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172187] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172187] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172187] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153727] {CVE-2026-23401} - nvme: avoid double free special payload (Maurizio Lombardi) [RHEL-51303] {CVE-2024-41073} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166921] {CVE-2025-68724} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Jay Shin) [RHEL-166155] {CVE-2025-40252} - kernel.h: Move ARRAY_SIZE() to a separate header (Jay Shin) [RHEL-166155] {CVE-2025-40252} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613} - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961] - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858} - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392} - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781} - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990} - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772] - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772] - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772] - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772] - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772] - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772] - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772] - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709} - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815] - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815] - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815] - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190} - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158} - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408} - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408} - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684} - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032] - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032] - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032] - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032] - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032] - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032] - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032] - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032] - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032] - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183} - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219] - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219] - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219] - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219] - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219] - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219] - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219] - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347} - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243} - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890] - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890] - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890] - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890] - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890] - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890] - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890] - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890] - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890] - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890] - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981} - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613} - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961] - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858} - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392} - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781} - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447] - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038} - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963] - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581} - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239} - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852} - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - Buffer overflow in drivers/xen/sys-hypervisor.c (CKI Backport Bot) [RHEL-172504] {CVE-2026-31786} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (José Expósito) [RHEL-178825] {CVE-2026-31488} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (Juri Lelli) [RHEL-178520] - RDMA/mana_ib: Validate rx_hash_key_len to prevent buffer overflow (Gaurav Goklani) [RHEL-180089] {CVE-2026-46145} - ALSA: aloop: Fix peer runtime UAF during format-change stop (Jaroslav Kysela) [RHEL-179304] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173939] {CVE-2026-43279} - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xin Long) [RHEL-168063] {CVE-2026-31419} - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056} - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669} - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: free pedit keys on bail from offset check (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: rate limit datapath messages (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: remove extra check for key type (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - net/sched: act_pedit: check static offsets a priori (Ivan Vecera) [RHEL-177582] {CVE-2026-46331} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180103] {CVE-2026-46135} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172764] {CVE-2026-43056} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - redhat: Temporary stop adding 'kernel' component to SBAT (Thomas Huth) [RHEL-182788] - redhat: Switch to implicit enablement of CONFIG_EFI_SBAT_FILE (Thomas Huth) [RHEL-182788] - redhat: Add SBAT information to Linux kernel (Thomas Huth) [RHEL-182788] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Thomas Huth) [RHEL-182788] - x86/efi: Implement support for embedding SBAT data for x86 (Thomas Huth) [RHEL-182788] - redhat: Add Kconfig switch for embedding SBAT section (Thomas Huth) [RHEL-182788] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179596] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179596] {CVE-2026-45984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179963] {CVE-2026-46189} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165556] {CVE-2026-23216} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179435] - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179435] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179435] - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179435] - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179435] - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179435] - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179435] - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179435] - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179435] - ovl: pass layer mnt to ovl_open_realfile() (Ondrej Mosnacek) [RHEL-179435] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - NFS: improve "Server wrote zero bytes" error (Olga Kornievskaia) [RHEL-147665] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add part number for Arm Cortex-A78AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-N3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A725 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-A720 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Cortex-715 CPU part definition (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add MIDR_CORTEX_A76AE (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X1C definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X925 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: cputype: Add Cortex-X4 definitions (Mark Salter) [RHEL-183619] {CVE-2025-10263} - arm64: Add Neoverse-V2 part (Mark Salter) [RHEL-183619] {CVE-2025-10263} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Antoine Tenart) [RHEL-174237] {CVE-2026-43198} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181898] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179907] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179857] {CVE-2026-46227} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179736] {CVE-2026-43450} - vfs: validate inode i_link before use in get_link() (Ian Kent) [RHEL-152759] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] - KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} - iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692} - fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976] - net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976] - dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976] - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923} - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214099] - bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Viktor Malik) [RHEL-191844] - [rt] build kernel-rt-4.18.0-553.16.1.rt7.357.el8_10 [RHEL-44553] - x86/bhi: Fix incorrect CLEAR_BRANCH_HISTORY position in entry_INT80_compat (Waiman Long) [RHEL-50648] - [rt] build kernel-rt-4.18.0-553.15.1.rt7.356.el8_10 [RHEL-44553] - Revert "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-44613] - ionic: fix use after netif_napi_del() (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - ionic: clean interrupt before enabling queue to avoid credit race (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change (CKI Backport Bot) [RHEL-49321] {CVE-2021-47624} - xhci: Handle TD clearing for multiple streams case (CKI Backport Bot) [RHEL-47882] {CVE-2024-40927} - net: openvswitch: Fix Use-After-Free in ovs_ct_exit (cki-backport-bot) [RHEL-36362] {CVE-2024-27395} - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: fix vlan use-after-free (cki-backport-bot) [RHEL-43721] {CVE-2024-36979} - irqchip/gic-v3-its: Prevent double free on error (Charles Mirabile) [RHEL-37022] {CVE-2024-35847} - irqchip/gic-v3-its: Fix potential VPE leak on error (Charles Mirabile) [RHEL-37744] {CVE-2021-47373} - i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() (Charles Mirabile) [RHEL-34735] {CVE-2022-48632} - iommu/dma: fix zeroing of bounce buffer padding used by untrusted devices (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: remove alloc_size argument to swiotlb_tbl_map_single() (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: fix swiotlb_bounce() to do partial sync's correctly (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Reinstate page-alignment for mappings >= PAGE_SIZE (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix alignment checks when both allocation and DMA masks are present (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix double-allocation of slots due to broken alignment handling (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (cki-backport-bot) [RHEL-44441] {CVE-2024-31076} - [rt] build kernel-rt-4.18.0-553.14.1.rt7.355.el8_10 [RHEL-44553] - s390/qeth: Fix kernel panic after setting hsuid (Mete Durlu) [RHEL-49754] - perf/core: Protect event sibling list locking against interrupt inversion (Daniel Vacek) [RHEL-31798] - vt: fix unicode buffer corruption when deleting characters (Steve Best) [RHEL-36936] {CVE-2024-35823} - cifs: translate network errors on send to -ECONNABORTED (Paulo Alcantara) [RHEL-36754] - xfs: don't block in busy flushing when freeing extents (Brian Foster) [RHEL-7984] - xfs: allow extent free intents to be retried (Brian Foster) [RHEL-7984] - xfs: pass alloc flags through to xfs_extent_busy_flush() (Brian Foster) [RHEL-7984] - xfs: use deferred frees for btree block freeing (Brian Foster) [RHEL-7984] - xfs: fix bounds check in xfs_defer_agfl_block() (Brian Foster) [RHEL-7984] - xfs: validate block number being freed before adding to xefi (Brian Foster) [RHEL-7984] - xfs: rename xfs_bmap_add_free to xfs_free_extent_later (Brian Foster) [RHEL-7984] - usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (Desnes Nunes) [RHEL-36803] {CVE-2024-35790} - stm class: Fix a double free in stm_register_device() (Steve Best) [RHEL-44514] {CVE-2024-38627} - s390/qeth: Fix potential loss of L3-IP@ in case of network issues (Mete Durlu) [RHEL-49755] - tls: fix missing memory barrier in tls_init (cki-backport-bot) [RHEL-44471] {CVE-2024-36489} - xfs: fix log recovery buffer allocation for the legacy h_size fixup (Bill O'Donnell) [RHEL-46473] {CVE-2024-39472} - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: use __for_each_thread() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - exit: Use the correct exit_code in /proc/<pid>/stat (Brian Foster) [RHEL-31562] {CVE-2024-26686} - scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool (Ewan D. Milne) [RHEL-38283] {CVE-2023-52811} - scsi: qla2xxx: Fix double free of fcport (Ewan D. Milne) [RHEL-39549] {CVE-2024-26929} - scsi: qla2xxx: Fix double free of the ha->vp_map pointer (Ewan D. Milne) [RHEL-39549] {CVE-2024-26930} - scsi: qla2xxx: Fix command flush on cable pull (Ewan D. Milne) [RHEL-39549] {CVE-2024-26931} - [rt] build kernel-rt-4.18.0-553.13.1.rt7.354.el8_10 [RHEL-44553] - redhat: remove handling of deleted rhdocs/ directory from genspec.sh (Denys Vlasenko) - x86/bugs: Fix BHI retpoline check (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI handling of RRSBA (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr' (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI documentation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix return type of spectre_bhi_state() (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Make CONFIG_SPECTRE_BHI_ON the default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Mitigate KVM by default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add BHI mitigation knob (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Enumerate Branch History Injection (BHI) bug (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Define SPEC_CTRL_BHI_DIS_S (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add support for clearing branch history at syscall entry (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file (Waiman Long) [RHEL-28202] - perf/x86/amd/lbr: Use freeze based on availability (Waiman Long) [RHEL-28202] - Documentation/kernel-parameters: Add spec_rstack_overflow to mitigations=off (Waiman Long) [RHEL-28202] - KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace (Waiman Long) [RHEL-28202] - x86/bugs: Reset speculation control settings on init (Waiman Long) [RHEL-28202] - KVM: x86: Update KVM-only leaf handling to allow for 100% KVM-only leafs (Waiman Long) [RHEL-28202] - KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest (Waiman Long) [RHEL-28202] - mptcp: ensure snd_nxt is properly initialized on connect (Davide Caratti) [RHEL-39865] {CVE-2024-36889} - powerpc/pseries: Enforce hcall result buffer validity and size (Mamatha Inamdar) [RHEL-48291] {CVE-2024-40974} - wifi: mac80211: fix potential key use-after-free (Jose Ignacio Tornos Martinez) [RHEL-28007] {CVE-2023-52530} - cppc_cpufreq: Fix possible null pointer dereference (Mark Langsdorf) [RHEL-44137] {CVE-2024-38573} - net/sched: act_mirred: use the backlog for mirred ingress (Davide Caratti) [RHEL-31718] {CVE-2024-26740} - vfio/pci: Lock external INTx masking ops (Alex Williamson) [RHEL-31922] {CVE-2024-26810} - net: sched: sch_multiq: fix possible OOB write in multiq_tune() (Davide Caratti) [RHEL-43464] {CVE-2024-36978} - tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized (Guillaume Nault) [RHEL-37850] {CVE-2021-47304} - pstore/ram: Fix crash when setting number of cpus to an odd number (Lenny Szubowicz) [RHEL-29471] {CVE-2023-52619} - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node (Jocelyn Falempe) [RHEL-37101] {CVE-2023-52662} - drm/vmwgfx: Fix the lifetime of the bo cursor memory (Jocelyn Falempe) [RHEL-36962] {CVE-2024-35810} - drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed (Jocelyn Falempe) [RHEL-34987] {CVE-2024-26940} - drm/vmwgfx: Unmap the surface before resetting it on a plane state (Jocelyn Falempe) [RHEL-35217] {CVE-2023-52648} - drm/vmwgfx: Fix invalid reads in fence signaled events (Jocelyn Falempe) [RHEL-40010] {CVE-2024-36960} - block: Fix wrong offset in bio_truncate() (Ming Lei) [RHEL-43782] {CVE-2022-48747} - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CKI Backport Bot) [RHEL-46913] {CVE-2024-39487} - net: fix __dst_negative_advice() race (Xin Long) [RHEL-41183] {CVE-2024-36971} - igc: avoid returning frame twice in XDP_REDIRECT (Corinna Vinschen) [RHEL-33264] {CVE-2024-26853} - mac802154: fix llsec key resources release in mac802154_llsec_key_del (Steve Best) [RHEL-34967] {CVE-2024-26961} - cpufreq: exit() callback is optional (Mark Langsdorf) [RHEL-43840] {CVE-2024-38615} - cifs: prevent infinite recursion in CIFSGetDFSRefer() (Paulo Alcantara) [RHEL-34672] - cifs: lock chan_lock outside match_session (Paulo Alcantara) [RHEL-34672] - smb3: workaround negprot bug in some Samba servers (Paulo Alcantara) [RHEL-34672] - smb3: use netname when available on secondary channels (Paulo Alcantara) [RHEL-34672] - smb3: fix empty netname context on secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: populate empty hostnames for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: always iterate smb sessions using primary channel (Paulo Alcantara) [RHEL-34672] - cifs: Fix connections leak when tlink setup failed (Paulo Alcantara) [RHEL-34672] - cifs: Fix memory leak when build ntlmssp negotiate blob failed (Paulo Alcantara) [RHEL-34672] - cifs: always initialize struct msghdr smb_msg completely (Paulo Alcantara) [RHEL-34672] - cifs: don't send down the destination address to sendmsg for a SOCK_STREAM (Paulo Alcantara) [RHEL-34672] - cifs: revalidate mapping when doing direct writes (Paulo Alcantara) [RHEL-34672] - cifs: skip extra NULL byte in filenames (Paulo Alcantara) [RHEL-34672] - cifs: list_for_each() -> list_for_each_entry() (Paulo Alcantara) [RHEL-34672] - smb2: small refactor in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - cifs: Fix crash on unload of cifs_arc4.ko (Paulo Alcantara) [RHEL-34672] - cifs: remove check of list iterator against head past the loop body (Paulo Alcantara) [RHEL-34672] - cifs: fix reconnect on smb3 mount types (Paulo Alcantara) [RHEL-34672] - cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (Paulo Alcantara) [RHEL-34672] - cifs: skip trailing separators of prefix paths (Paulo Alcantara) [RHEL-34672] - cifs: fix ntlmssp on old servers (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL ptr dereference in refresh_mounts() (Paulo Alcantara) [RHEL-34672] - cifs: do not skip link targets when an I/O fails (Paulo Alcantara) [RHEL-34672] - cifs: fix confusing unneeded warning message on smb2.1 and earlier (Paulo Alcantara) [RHEL-34672] - smb3: fix snapshot mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix workstation_name for multiuser mounts (Paulo Alcantara) [RHEL-34672] - cifs: alloc_path_with_tree_prefix: do not append sep. if the path is empty (Paulo Alcantara) [RHEL-34672] - cifs: free ntlmsspblob allocated in negotiate (Paulo Alcantara) [RHEL-34672] - cifs: avoid use of dstaddr as key for fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: add server conn_id to fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: fix missed refcounting of ipc tcon (Paulo Alcantara) [RHEL-34672] - smb2: clarify rc initialization in smb2_reconnect (Paulo Alcantara) [RHEL-34672] - cifs: populate server_hostname for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should be set on new server (Paulo Alcantara) [RHEL-34672] - cifs: introduce cifs_ses_mark_for_reconnect() helper (Paulo Alcantara) [RHEL-34672] - cifs: protect srv_count with cifs_tcp_ses_lock (Paulo Alcantara) [RHEL-34672] - cifs: move debug print out of spinlock (Paulo Alcantara) [RHEL-34672] - cifs: do not duplicate fscache cookie for secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: connect individual channel servers to primary channel server (Paulo Alcantara) [RHEL-34672] - cifs: protect session channel fields with chan_lock (Paulo Alcantara) [RHEL-34672] - cifs: do not negotiate session if session already exists (Paulo Alcantara) [RHEL-34672] - smb3: do not setup the fscache_super_cookie until fsinfo initialized (Paulo Alcantara) [RHEL-34672] - cifs: fix potential use-after-free bugs (Paulo Alcantara) [RHEL-34672] - cifs: release lock earlier in dequeue_mid error case (Paulo Alcantara) [RHEL-34672] - smb3: remove trivial dfs compile warning (Paulo Alcantara) [RHEL-34672] - cifs: support nested dfs links over reconnect (Paulo Alcantara) [RHEL-34672] - cifs: for compound requests, use open handle if possible (Paulo Alcantara) [RHEL-34672] - cifs: split out dfs code from cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant (Paulo Alcantara) [RHEL-34672] - cifs: introduce new helper for cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: fix print of hdr_flags in dfscache_proc_show() (Paulo Alcantara) [RHEL-34672] - cifs: send workstation name during ntlmssp session setup (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should not share socket with future sessions (Paulo Alcantara) [RHEL-34672] - smb3: add dynamic trace points for socket connection (Paulo Alcantara) [RHEL-34672] - cifs: Move SMB2_Create definitions to the shared area (Paulo Alcantara) [RHEL-34672] - cifs: Move more definitions into the shared area (Paulo Alcantara) [RHEL-34672] - cifs: move NEGOTIATE_PROTOCOL definitions out into the common area (Paulo Alcantara) [RHEL-34672] - cifs: Create a new shared file holding smb2 pdu definitions (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect check for null pointer in header_assemble (Paulo Alcantara) [RHEL-34672] - smb3: correct server pointer dereferencing check to be more consistent (Paulo Alcantara) [RHEL-34672] - cifs: Deal with some warnings from W=1 (Paulo Alcantara) [RHEL-34672] - cifs: fix a sign extension bug (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect kernel doc comments (Paulo Alcantara) [RHEL-34672] - cifs: remove pathname for file from SPDX header (Paulo Alcantara) [RHEL-34672] - cifs: move SMB FSCTL definitions to common code (Paulo Alcantara) [RHEL-34672] - cifs: rename cifs_common to smbfs_common (Paulo Alcantara) [RHEL-34672] - cifs: update FSCTL definitions (Paulo Alcantara) [RHEL-34672] - cifs: cifs_md4 convert to SPDX identifier (Paulo Alcantara) [RHEL-34672] - cifs: create a MD4 module and switch cifs.ko to use it (Paulo Alcantara) [RHEL-34672] - cifs: fork arc4 and create a separate module for it for cifs and other users (Paulo Alcantara) [RHEL-34672] - smb3: fix posix extensions mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix wrong release in sess_alloc_buffer() failed path (Paulo Alcantara) [RHEL-34672] - CIFS: Fix a potencially linear read overflow (Paulo Alcantara) [RHEL-34672] - cifs: use the correct max-length for dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: create sd context must be a multiple of 8 (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp sessions of dfs connections (Paulo Alcantara) [RHEL-34672] - cifs: added WARN_ON for all the count decrements (Paulo Alcantara) [RHEL-34672] - cifs: fix missing null session check in mount (Paulo Alcantara) [RHEL-34672] - cifs: handle reconnect of tcon when there is no cached dfs referral (Paulo Alcantara) [RHEL-34672] - cifs: fix the out of range assignment to bit fields in parse_server_interfaces (Paulo Alcantara) [RHEL-34672] - smb3: fix typo in header file (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: Add support for negotiating signing algorithm (Paulo Alcantara) [RHEL-34672] - cifs: prevent NULL deref in cifs_compose_mount_options() (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL dereference in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - smbdirect: missing rc checks while waiting for rdma events (Paulo Alcantara) [RHEL-34672] - cifs: Avoid field over-reading memcpy() (Paulo Alcantara) [RHEL-34672] - smb311: remove dead code for non compounded posix query info (Paulo Alcantara) [RHEL-34672] - cifs: fix SMB1 error path in cifs_get_file_info_unix (Paulo Alcantara) [RHEL-34672] - smb3: fix uninitialized value for port in witness protocol move (Paulo Alcantara) [RHEL-34672] - cifs: fix unneeded null check (Paulo Alcantara) [RHEL-34672] - cifs: use SPDX-Licence-Identifier (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in cifs_debug.c (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in smb2misc.c (Paulo Alcantara) [RHEL-34672] - cifs: missed ref-counting smb session in find (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp servers with dfs mounts (Paulo Alcantara) [RHEL-34672] - cifs: set a minimum of 2 minutes for refreshing dfs cache (Paulo Alcantara) [RHEL-34672] - cifs: Remove unused inline function is_sysvol_or_netlogon() (Paulo Alcantara) [RHEL-34672] - cifs: remove duplicated prototype (Paulo Alcantara) [RHEL-34672] - cifs: fix ipv6 formating in cifs_ses_add_channel (Paulo Alcantara) [RHEL-34672] - cifs: fix string declarations and assignments in tracepoints (Paulo Alcantara) [RHEL-34672] - cifs: fix memory leak in smb2_copychunk_range (Paulo Alcantara) [RHEL-34672] - SMB3: incorrect file id in requests compounded with open (Paulo Alcantara) [RHEL-34672] - smb3: if max_channels set to more than one channel request multichannel (Paulo Alcantara) [RHEL-34672] - smb3: do not attempt multichannel to server which does not support it (Paulo Alcantara) [RHEL-34672] - smb3: when mounting with multichannel include it in requested capabilities (Paulo Alcantara) [RHEL-34672] - cifs: simplify SWN code with dummy funcs instead of ifdefs (Paulo Alcantara) [RHEL-34672] - cifs: log mount errors using cifs_errorf() (Paulo Alcantara) [RHEL-34672] - cifs: switch build_path_from_dentry() to using dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: fix out-of-bound memory access when calling smb3_notify() at mount point (Paulo Alcantara) [RHEL-34672] - cifs: allocate buffer in the caller of build_path_from_dentry() (Paulo Alcantara) [RHEL-34672] - cifs: make build_path_from_dentry() return const char * (Paulo Alcantara) [RHEL-34672] - cifs: remove old dead code (Paulo Alcantara) [RHEL-34672] - fs: cifs: Remove repeated struct declaration (Paulo Alcantara) [RHEL-34672] - cifs: have cifs_fattr_to_inode() refuse to change type on live inode (Paulo Alcantara) [RHEL-34672] - cifs: have ->mkdir() handle race with another client sanely (Paulo Alcantara) [RHEL-34672] - do_cifs_create(): don't set ->i_mode of something we had not created (Paulo Alcantara) [RHEL-34672] - cifs: Silently ignore unknown oplock break handle (Paulo Alcantara) [RHEL-34672] - cifs: change noisy error message to FYI (Paulo Alcantara) [RHEL-34672] - cifs: print MIDs in decimal notation (Paulo Alcantara) [RHEL-34672] - cifs: minor simplification to smb2_is_network_name_deleted (Paulo Alcantara) [RHEL-34672] - TCON Reconnect during STATUS_NETWORK_NAME_DELETED (Paulo Alcantara) [RHEL-34672] - cifs: clarify hostname vs ip address in /proc/fs/cifs/DebugData (Paulo Alcantara) [RHEL-34672] - cifs: change confusing field serverName (to ip_addr) (Paulo Alcantara) [RHEL-34672] - cifs: Reformat DebugData and index connections by conn_id. (Paulo Alcantara) [RHEL-34672] - cifs: Identify a connection by a conn_id. (Paulo Alcantara) [RHEL-34672] - smb3: negotiate current dialect (SMB3.1.1) when version 3 or greater requested (Paulo Alcantara) [RHEL-34672] - smb3: Fix out-of-bounds bug in SMB2_negotiate() (Paulo Alcantara) [RHEL-34672] - fs/cifs: Simplify bool comparison. (Paulo Alcantara) [RHEL-34672] - fs/cifs: Assign boolean values to a bool variable (Paulo Alcantara) [RHEL-34672] - cifs: Avoid error pointer dereference (Paulo Alcantara) [RHEL-34672] - cifs: Re-indent cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Unlock on errors in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Delete a stray unlock in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Tracepoints and logs for tracing credit changes. (Paulo Alcantara) [RHEL-34672] - cifs: Fix some error pointers handling detected by static checker (Paulo Alcantara) [RHEL-34672] - smb3: remind users that witness protocol is experimental (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: do not log warning message if server doesn't populate salt (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: update comments clarifying SPNEGO info in negprot response (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot rsp (Paulo Alcantara) [RHEL-34672] - SMB3: avoid confusing warning message on mount to Azure (Paulo Alcantara) [RHEL-34672] - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (Nigel Croxon) [RHEL-46662] {CVE-2024-39476} - net: fix information leakage in /proc/net/ptype (Hangbin Liu) [RHEL-44000] {CVE-2022-48757} - usb: typec: ucsi: Limit read size on v1.2 (Desnes Nunes) [RHEL-37286] {CVE-2024-35924} - minmax: relax check to allow comparison between unsigned arguments and signed constants (Desnes Nunes) [RHEL-37286] - minmax: allow comparisons of 'int' against 'unsigned char/short' (Desnes Nunes) [RHEL-37286] - minmax: allow min()/max()/clamp() if the arguments have the same signedness. (Desnes Nunes) [RHEL-37286] - minmax: add umin(a, b) and umax(a, b) (Desnes Nunes) [RHEL-37286] - minmax: fix header inclusions (Desnes Nunes) [RHEL-37286] - minmax: clamp more efficiently by avoiding extra comparison (Desnes Nunes) [RHEL-37286] - minmax: sanity check constant bounds when clamping (Desnes Nunes) [RHEL-37286] - tracing: Define the is_signed_type() macro once (Desnes Nunes) [RHEL-37286] - linux/bits.h: fix compilation error with GENMASK (Desnes Nunes) [RHEL-37286] - x86/apic: Mask IOAPIC entries when disabling the local APIC (Lenny Szubowicz) [RHEL-18077] - userfaultfd: fix a race between writeprotect and exit_mmap() (Rafael Aquini) [RHEL-38410] {CVE-2021-47461} - mm: khugepaged: skip huge page collapse for special files (Waiman Long) [RHEL-38446] {CVE-2021-47491} - cachefiles: fix memory leak in cachefiles_add_cache() (Andrey Albershteyn) [RHEL-33109] {CVE-2024-26840} - drm/amd/display: Implement bounds check for stream encoder creation in DCN301 (Michel Dänzer) [RHEL-31429] {CVE-2024-26660} - net/mlx5: Discard command completions in internal error (Kamal Heib) [RHEL-44231] {CVE-2024-38555} - drm: Don't unref the same fb many times by mistake due to deadlock handling (CKI Backport Bot) [RHEL-29011] {CVE-2023-52486} - md: fix resync softlockup when bitmap size is less than array size (Nigel Croxon) [RHEL-43942] {CVE-2024-38598} - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation (Davide Caratti) [RHEL-39712] {CVE-2024-36017} - netfilter: nf_tables: discard table flag update with pending basechain deletion (Phil Sutter) [RHEL-37205] {CVE-2024-35897} - netfilter: nf_tables: reject table flag and netdev basechain updates (Phil Sutter) [RHEL-37205] - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (Ewan D. Milne) [RHEL-40172] {CVE-2024-36924} - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (Ewan D. Milne) [RHEL-40172] {CVE-2024-36952} - netfilter: nf_tables: fix memleak in map from abort path (Phil Sutter) [RHEL-35052] {CVE-2024-27011} - netfilter: nf_tables: reject new basechain after table flag update (Phil Sutter) [RHEL-37193] {CVE-2024-35900} - netfilter: nf_tables: flush pending destroy work before exit_net release (Phil Sutter) [RHEL-37197] {CVE-2024-35899} - netfilter: complete validation of user input (Phil Sutter) [RHEL-37210] - netfilter: validate user input for expected length (Phil Sutter) [RHEL-37210] {CVE-2024-35896} - netfilter: tproxy: bail out if IP has been disabled on the device (Phil Sutter) [RHEL-44363] {CVE-2024-36270} - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (Phil Sutter) [RHEL-44532] {CVE-2024-36286} - netfilter: nf_tables: do not compare internal table flags on updates (Phil Sutter) [RHEL-35114] {CVE-2024-27065} - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (Phil Sutter) [RHEL-35028] {CVE-2024-27019} - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (Phil Sutter) [RHEL-35024] {CVE-2024-27020} - netfilter: nf_tables: __nft_expr_type_get() selects specific family type (Phil Sutter) [RHEL-35024] - netfilter: conntrack: serialize hash resizes and cleanups (Phil Sutter) [RHEL-37703] {CVE-2021-47408} - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (Phil Sutter) [RHEL-34217] {CVE-2024-26925} - netfilter: nf_tables: release batch on table validation from abort path (Phil Sutter) [RHEL-34217] - ipvlan: add ipvlan_route_v6_outbound() helper (Davide Caratti) [RHEL-38319] {CVE-2023-52796} - [rt] build kernel-rt-4.18.0-553.12.1.rt7.353.el8_10 [RHEL-44553] - net: bridge: xmit: make sure we have at least eth header len bytes (cki-backport-bot) [RHEL-44291] {CVE-2024-38538} - drivers/amd/pm: fix a use-after-free in kv_parse_power_table (Michel Dänzer) [RHEL-26893] {CVE-2023-52469} - SUNRPC: Fix a suspicious RCU usage warning (Scott Mayhew) [RHEL-30503] {CVE-2023-52623} - ice: Fix some null pointer dereference issues in ice_ptp.c (Petr Oros) [RHEL-26901] {CVE-2023-52471} - xfs: fix internal error from AGFL exhaustion (Pavel Reichl) [RHEL-45581] - sched/psi: Fix use-after-free in ep_remove_wait_queue() (Phil Auld) [RHEL-38117] {CVE-2023-52707} - wait: add wake_up_pollfree() (Phil Auld) [RHEL-38117] - net/ipv6: avoid possible UAF in ip6_route_mpath_notify() (Hangbin Liu) [RHEL-33269] {CVE-2024-26852} - net: bridge: switchdev: Skip MDB replays of deferred events on offload (Ivan Vecera) [RHEL-33117] {CVE-2024-26837} - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (Pavel Reichl) [RHEL-31700] {CVE-2024-26772} - ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() (Pavel Reichl) [RHEL-31688] {CVE-2024-26773} - ext4: fix double-free of blocks due to wrong extents moved_len (Pavel Reichl) [RHEL-31612] {CVE-2024-26704} - vxlan: Pull inner IP header in vxlan_xmit_one(). (Guillaume Nault) [RHEL-31389] - geneve: Fix incorrect inner network header offset when innerprotoinherit is set (Guillaume Nault) [RHEL-31389] - vxlan: Pull inner IP header in vxlan_rcv(). (Guillaume Nault) [RHEL-31389] - geneve: fix header validation in geneve[6]_xmit_skb (Guillaume Nault) [RHEL-31389] - geneve: make sure to pull inner header in geneve_rx() (Guillaume Nault) [RHEL-31389] - net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb (Guillaume Nault) [RHEL-31389] - net: geneve: check skb is large enough for IPv4/IPv6 header (Guillaume Nault) [RHEL-31389] - net/smc: fix neighbour and rtable leak in smc_ib_find_route() (Tobias Huschle) [RHEL-39744] {CVE-2024-36945} - igb: Fix string truncation warnings in igb_set_fw_version (Corinna Vinschen) [RHEL-38452] {CVE-2024-36010} - bonding: stop the device in bond_setup_by_slave() (Hangbin Liu) [RHEL-38327] {CVE-2023-52784} - i40e: fix vf may be used uninitialized in this function warning (Kamal Heib) [RHEL-39702] {CVE-2024-36020} - powerpc/64: Fix the definition of the fixmap area (Mamatha Inamdar) [RHEL-27191] {CVE-2021-47018} - powerpc/mm/hash64: Add a variable to track the end of IO mapping (Mamatha Inamdar) [RHEL-27191] {CVE-2021-47018} - nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). (Xin Long) [RHEL-39770] {CVE-2024-36933} - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (Xin Long) [RHEL-39770] - net: core: reject skb_copy(_expand) for fraglist GSO skbs (Xin Long) [RHEL-39779] {CVE-2024-36929} - tcp: properly terminate timers for kernel sockets (Guillaume Nault) [RHEL-37171] {CVE-2024-35910} - net: relax socket state check at accept time. (Florian Westphal) [RHEL-39831] - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (Florian Westphal) [RHEL-39831] {CVE-2024-36905} - tcp: remove redundant check on tskb (Florian Westphal) [RHEL-39831] - drm/ast: Fix soft lockup (cki-backport-bot) [RHEL-37438] {CVE-2024-35952} - null_blk: Fix return value of nullb_device_power_store() (Ming Lei) [RHEL-39341] - null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues' (Ming Lei) [RHEL-39341] - null_blk: fix return value from null_add_dev() (Ming Lei) [RHEL-39341] - [rt] build kernel-rt-4.18.0-553.11.1.rt7.352.el8_10 [RHEL-44553] - x86/bugs: Reverse instruction order of CLEAR_CPU_BUFFERS (Waiman Long) [RHEL-42121] - Revert "x86/bugs: Use fixed addressing for VERW operand" (Waiman Long) [RHEL-42121] - KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests (Waiman Long) [RHEL-42121] - x86/rfds: Mitigate Register File Data Sampling (RFDS) (Waiman Long) [RHEL-42121] - Documentation/hw-vuln: Add documentation for RFDS (Waiman Long) [RHEL-42121] - x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set (Waiman Long) [RHEL-42121] - x86/bugs: Use fixed addressing for VERW operand (Waiman Long) [RHEL-42121] - KVM/VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH (Waiman Long) [RHEL-42121] - x86/bugs: Use ALTERNATIVE() instead of mds_user_clear static key (Waiman Long) [RHEL-42121] - x86/entry_32: Add VERW just before userspace transition (Waiman Long) [RHEL-42121] - x86/entry_64: Add VERW just before userspace transition (Waiman Long) [RHEL-42121] - x86/bugs: Add asm helpers for executing VERW (Waiman Long) [RHEL-42121] - x86/cpu: Fix Gracemont uarch (Waiman Long) [RHEL-42121] - Documentation/hw-vuln: Unify filename specification in index (Waiman Long) [RHEL-42121] - KVM: VMX: Access @flags as a 32-bit value in __vmx_vcpu_run() (Waiman Long) [RHEL-42121] - x86/asm: Add _ASM_RIP() macro for x86-64 (%rip) suffix (Waiman Long) [RHEL-42121] - x86/asm: Have the __ASM_FORM macros handle commas in arguments (Waiman Long) [RHEL-42121] - x86/asm: Allow to pass macros to __ASM_FORM() (Waiman Long) [RHEL-42121] - wifi: iwlwifi: mvm: guard against invalid STA ID on removal (Jose Ignacio Tornos Martinez) [RHEL-39801] {CVE-2024-36921} - ipv6: Fix potential uninit-value access in __ip6_make_skb() (Antoine Tenart) [RHEL-39784] - ipv4: Fix uninit-value access in __ip_make_skb() (Antoine Tenart) [RHEL-39784] {CVE-2024-36927} - perf mmap: Lazily initialize zstd streams to save memory when not using it (Michael Petlan) [RHEL-34876] - perf tools: Fix spelling mistake "commpressor" -> "compressor" (Michael Petlan) [RHEL-34876] - perf record: Introduce data transferred and compressed stats (Michael Petlan) [RHEL-34876] - perf record: Introduce compressor at mmap buffer object (Michael Petlan) [RHEL-34876] - perf record: Introduce bytes written stats (Michael Petlan) [RHEL-34876] - perf record: Introduce data file at mmap buffer object (Michael Petlan) [RHEL-34876] - perf record: Start threads in the beginning of trace streaming (Alexey Bayduraev) [RHEL-34876] - perf record: Stop threads in the end of trace streaming (Michael Petlan) [RHEL-34876] - perf record: Introduce thread local variable (Michael Petlan) [RHEL-34876] - perf record: Introduce function to propagate control commands (Michael Petlan) [RHEL-34876] - perf record: Introduce thread specific data array (Michael Petlan) [RHEL-34876] - tools lib: Introduce fdarray duplicate function (Michael Petlan) [RHEL-34876] - perf record: Introduce thread affinity and mmap masks (Michael Petlan) [RHEL-34876] - gfs2: Be more careful with the quota sync generation (Andreas Gruenbacher) [RHEL-40901] - gfs2: Get rid of some unnecessary quota locking (Andreas Gruenbacher) [RHEL-40901] - gfs2: Add some missing quota locking (Andreas Gruenbacher) [RHEL-40901] - gfs2: Fold qd_fish into gfs2_quota_sync (Andreas Gruenbacher) [RHEL-40901] - gfs2: quota need_sync cleanup (Andreas Gruenbacher) [RHEL-40901] - gfs2: Fix and clean up function do_qc (Andreas Gruenbacher) [RHEL-40901] - gfs2: Revert "Add quota_change type" (Andreas Gruenbacher) [RHEL-40901] - gfs2: Revert "ignore negated quota changes" (Andreas Gruenbacher) [RHEL-40901] - gfs2: qd_check_sync cleanups (Andreas Gruenbacher) [RHEL-40901] - gfs2: Check quota consistency on mount (Andreas Gruenbacher) [RHEL-40901] - gfs2: Minor gfs2_quota_init error path cleanup (Andreas Gruenbacher) [RHEL-40901] - gfs2: fix kernel BUG in gfs2_quota_cleanup (Edward Adam Davis) [RHEL-40901] - gfs2: Clean up quota.c:print_message (Andreas Gruenbacher) [RHEL-40901] - gfs2: Clean up gfs2_alloc_parms initializers (Andreas Gruenbacher) [RHEL-40901] - gfs2: Two quota=account mode fixes (Andreas Gruenbacher) [RHEL-40901] - gfs2: Remove useless assignment (Bob Peterson) [RHEL-40901] - gfs2: simplify slot_get (Bob Peterson) [RHEL-40901] - gfs2: Simplify qd2offset (Bob Peterson) [RHEL-40901] - gfs2: Remove quota allocation info from quota file (Bob Peterson) [RHEL-40901] - gfs2: use constant for array size (Bob Peterson) [RHEL-40901] - gfs2: Set qd_sync_gen in do_sync (Bob Peterson) [RHEL-40901] - gfs2: Remove useless err set (Bob Peterson) [RHEL-40901] - gfs2: Small gfs2_quota_lock cleanup (Bob Peterson) [RHEL-40901] - gfs2: move qdsb_put and reduce redundancy (Bob Peterson) [RHEL-40901] - gfs2: Don't try to sync non-changes (Bob Peterson) [RHEL-40901] - gfs2: Simplify function need_sync (Bob Peterson) [RHEL-40901] - gfs2: remove unneeded pg_oflow variable (Bob Peterson) [RHEL-40901] - gfs2: remove unneeded variable done (Bob Peterson) [RHEL-40901] - gfs2: pass sdp to gfs2_write_buf_to_page (Bob Peterson) [RHEL-40901] - gfs2: pass sdp in to gfs2_write_disk_quota (Bob Peterson) [RHEL-40901] - gfs2: Pass sdp to gfs2_adjust_quota (Bob Peterson) [RHEL-40901] - gfs2: remove dead code for quota writes (Bob Peterson) [RHEL-40901] - gfs2: Use qd_sbd more consequently (Bob Peterson) [RHEL-40901] - gfs2: replace 'found' with dedicated list iterator variable (Jakob Koschel) [RHEL-40901] - gfs2: Some whitespace cleanups (Andreas Gruenbacher) [RHEL-40901] - gfs2: Fix gfs2_qa_get imbalance in gfs2_quota_hold (Bob Peterson) [RHEL-40901] - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg (Guillaume Nault) [RHEL-43961] {CVE-2024-38596} - af_unix: Fix data-races around sk->sk_shutdown. (Guillaume Nault) [RHEL-43961] {CVE-2024-38596} - af_unix: Fix data races around sk->sk_shutdown. (Guillaume Nault) [RHEL-43961] {CVE-2024-38596} - perf/core: Fix event sibling list locking (Daniel Vacek) [RHEL-31798] - media: bttv: fix use after free error due to btv->timeout timer (Kate Hsuan) [RHEL-38256] {CVE-2023-52847} - arp: Prevent overflow in arp_req_get(). (Antoine Tenart) [RHEL-31706] {CVE-2024-26733} - Bluetooth: btusb: Add a new PID/VID 0489/e0c8 for MT7921 (David Marlin) [RHEL-10263] - mm: swap: fix race between free_swap_and_cache() and swapoff() (Waiman Long) [RHEL-34971] {CVE-2024-26960} - swap: comments get_swap_device() with usage rule (Waiman Long) [RHEL-34971] {CVE-2024-26960} - mm/swapfile.c: __swap_entry_free() always free 1 entry (Waiman Long) [RHEL-34971] {CVE-2024-26960} - mm/swapfile.c: call free_swap_slot() in __swap_entry_free() (Waiman Long) [RHEL-34971] {CVE-2024-26960} - mm/swapfile.c: use __try_to_reclaim_swap() in free_swap_and_cache() (Waiman Long) [RHEL-34971] {CVE-2024-26960} - net: amd-xgbe: Fix skb data length underflow (Ken Cox) [RHEL-43788] {CVE-2022-48743} - ovl: fix warning in ovl_create_real() (cki-backport-bot) [RHEL-43652] {CVE-2021-47579} - net/sched: initialize noop_qdisc owner (Davide Caratti) [RHEL-35056] - net/sched: Fix mirred deadlock on device recursion (Davide Caratti) [RHEL-35056] {CVE-2024-27010} - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (Pavel Reichl) [RHEL-45029] {CVE-2024-39276} - ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() (Ken Cox) [RHEL-38713] {CVE-2021-47548} - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound (Hangbin Liu) [RHEL-44396] {CVE-2024-33621} - mlxsw: spectrum_acl_tcam: Fix stack corruption (Ivan Vecera) [RHEL-26462] {CVE-2024-26586} - inet: inet_defrag: prevent sk release while still in use (Antoine Tenart) [RHEL-33398] {CVE-2024-26921} - skb_expand_head() adjust skb->truesize incorrectly (Antoine Tenart) [RHEL-33398] - nvmet: fix ns enable/disable possible hang (Ming Lei) [RHEL-43547] - [rt] build kernel-rt-4.18.0-553.10.1.rt7.351.el8_10 [RHEL-44553] - SUNRPC: Fix RPC client cleaned up the freed pipefs dentries (Scott Mayhew) [RHEL-38264] {CVE-2023-52803} - scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() (Ewan D. Milne) [RHEL-39717] {CVE-2024-36025} - tcp: add sanity checks to rx zerocopy (Guillaume Nault) [RHEL-29494] {CVE-2024-26640} - SUNRPC: fix some memleaks in gssx_dec_option_array (Scott Mayhew) [RHEL-35209] {CVE-2024-27388} - wifi: nl80211: don't free NULL coalescing rule (Jose Ignacio Tornos Martinez) [RHEL-39752] {CVE-2024-36941} - nfs: fix UAF in direct writes (Scott Mayhew) [RHEL-34975] {CVE-2024-26958} - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 (Scott Mayhew) [RHEL-33228] {CVE-2024-26870} - drm/amd/pm: Fix error of MACO flag setting code (Michel Dänzer) [RHEL-15928] - scsi: aacraid: fix io hangs and improve performance (John Meneghini) [RHEL-23913] - block: prevent division by zero in blk_rq_stat_sum() (Ming Lei) [RHEL-37279] {CVE-2024-35925} - block: fix overflow in blk_ioctl_discard() (Ming Lei) [RHEL-39811] {CVE-2024-36917} - virtio-blk: fix implicit overflow on virtio_max_dma_size (Ming Lei) [RHEL-38131] {CVE-2023-52762} - nbd: null check for nla_nest_start (Ming Lei) [RHEL-35176] {CVE-2024-27025} - isdn: mISDN: netjet: Fix crash in nj_probe: (Ken Cox) [RHEL-38444] {CVE-2021-47284} - isdn: mISDN: Fix sleeping function called from invalid context (Ken Cox) [RHEL-38400] {CVE-2021-47468} - net/smc: avoid data corruption caused by decline (Tobias Huschle) [RHEL-38234] {CVE-2023-52775} - ubi: Check for too small LEB size in VTBL code (David Arcari) [RHEL-25092] {CVE-2024-25739} - i2c: core: Fix atomic xfer check for non-preempt config (Steve Best) [RHEL-38313] {CVE-2023-52791} - i2c: core: Run atomic i2c xfer when !preemptible (Steve Best) [RHEL-38313] {CVE-2023-52791} - firewire: ohci: mask bus reset interrupts between ISR and bottom half (Steve Best) [RHEL-39902] {CVE-2024-36950} - ipv6: init the accept_queue's spinlocks in inet6_create (Guillaume Nault) [RHEL-28899] {CVE-2024-26614} - tcp: make sure init the accept_queue's spinlocks once (Guillaume Nault) [RHEL-28899] {CVE-2024-26614} - tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (Steve Best) [RHEL-39352] {CVE-2024-36016} - mlxsw: spectrum_acl_tcam: Fix incorrect list API usage (Ivan Vecera) [RHEL-37484] {CVE-2024-36006} - pwm: Fix double shift bug (Steve Best) [RHEL-38278] {CVE-2023-52756} - mmc: sdio: fix possible resource leaks in some error paths (Steve Best) [RHEL-38149] {CVE-2023-52730} - of: unittest: Fix compile in the non-dynamic case (Steve Best) [RHEL-37070] {CVE-2023-52679} - of: unittest: Fix of_count_phandle_with_args() expected value message (Steve Best) [RHEL-37070] {CVE-2023-52679} - of: Fix double free in of_parse_phandle_with_args_map (Steve Best) [RHEL-37070] {CVE-2023-52679} - pinctrl: core: delete incorrect free in pinctrl_enable() (Steve Best) [RHEL-39756] {CVE-2024-36940} - pinctrl: core: fix possible memory leak in pinctrl_enable() (Steve Best) [RHEL-39756] {CVE-2024-36940} - media: gspca: cpia1: shift-out-of-bounds in set_flicker (Desnes Nunes) [RHEL-38331] {CVE-2023-52764} - tipc: fix a possible memleak in tipc_buf_append (Xin Long) [RHEL-39881] {CVE-2024-36954} - cifs: fix mid leak during reconnection after timeout threshold (Paulo Alcantara) [RHEL-36222] - cifs: Fix use-after-free in rdata->read_into_pages() (Paulo Alcantara) [RHEL-36222] - cifs: Fix pages leak when writedata alloc failed in cifs_write_from_iter() (Paulo Alcantara) [RHEL-36222] - cifs: Fix pages array leak when writedata alloc failed in cifs_writedata_alloc() (Paulo Alcantara) [RHEL-36222] - cifs: destage dirty pages before re-reading them for cache=none (Paulo Alcantara) [RHEL-36222] - cifs: destage any unwritten data to the server before calling copychunk_write (Paulo Alcantara) [RHEL-36222] - Adjust cifssb maximum read size (Paulo Alcantara) [RHEL-36222] - cifs: make locking consistent around the server session status (Paulo Alcantara) [RHEL-36222] - cifs: fix credit accounting for extra channel (Paulo Alcantara) [RHEL-36222] - smb3: prevent races updating CurrentMid (Paulo Alcantara) [RHEL-36222] - cifs: fix missing spinlock around update to ses->status (Paulo Alcantara) [RHEL-36222] - cifs: use echo_interval even when connection not ready. (Paulo Alcantara) [RHEL-36222] - cifs: detect dead connections only when echoes are enabled. (Paulo Alcantara) [RHEL-36222] - cifs: Fix preauth hash corruption (Paulo Alcantara) [RHEL-36222] - cifs: do not send close in compound create+close requests (Paulo Alcantara) [RHEL-36222] - cifs: ask for more credit on async read/write code paths (Paulo Alcantara) [RHEL-36222] - cifs: use discard iterator to discard unneeded network data more efficiently (Paulo Alcantara) [RHEL-36222] - cifs: Fix in error types returned for out-of-credit situations. (Paulo Alcantara) [RHEL-36222] - smb3: fix crediting for compounding when only one request in flight (Paulo Alcantara) [RHEL-36222] - cifs: New optype for session operations. (Paulo Alcantara) [RHEL-36222] - mm/gup: do not return 0 from pin_user_pages_fast() for bad args (Paulo Alcantara) [RHEL-36222] - wifi: brcmfmac: pcie: handle randbuf allocation failure (Jose Ignacio Tornos Martinez) [RHEL-44124] {CVE-2024-38575} - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). (Guillaume Nault) [RHEL-39835] {CVE-2024-36904} - wifi: mac80211: don't return unset power in ieee80211_get_tx_power() (Jose Ignacio Tornos Martinez) [RHEL-38159] {CVE-2023-52832} - wifi: ath11k: fix gtk offload status event locking (Jose Ignacio Tornos Martinez) [RHEL-38155] {CVE-2023-52777} - net: ieee802154: fix null deref in parse dev addr (Steve Best) [RHEL-38012] {CVE-2021-47257} - mm/hugetlb: fix missing hugetlb_lock for resv uncharge (Rafael Aquini) [RHEL-37465] {CVE-2024-36000} - x86/xen: Add some null pointer checking to smp.c (Vitaly Kuznetsov) [RHEL-33258] {CVE-2024-26908} - x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() (Vitaly Kuznetsov) [RHEL-33258] {CVE-2024-26908} - wifi: cfg80211: check A-MSDU format more carefully (Jose Ignacio Tornos Martinez) [RHEL-37343] {CVE-2024-35937} - wifi: rtw89: fix null pointer access when abort scan (Jose Ignacio Tornos Martinez) [RHEL-37355] {CVE-2024-35946} - atl1c: Work around the DMA RX overflow issue (Ken Cox) [RHEL-38287] {CVE-2023-52834} - wifi: ath11k: decrease MHI channel buffer length to 8KB (Jose Ignacio Tornos Martinez) [RHEL-37339] {CVE-2024-35938} - wifi: iwlwifi: mvm: rfi: fix potential response leaks (Jose Ignacio Tornos Martinez) [RHEL-37163] {CVE-2024-35912} - USB: core: Fix access violation during port device removal (Desnes Nunes) [RHEL-39853] {CVE-2024-36896} - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() (Ewan D. Milne) [RHEL-37123] {CVE-2024-35930} - netfilter: nf_tables: honor table dormant flag from netdev release event path (Phil Sutter) [RHEL-37450] {CVE-2024-36005} - wifi: iwlwifi: mvm: don't set the MFP flag for the GTK (Jose Ignacio Tornos Martinez) [RHEL-36898] {CVE-2024-27434} - wifi: iwlwifi: mvm: Fix key flags for IGTK on AP interface (Jose Ignacio Tornos Martinez) [RHEL-36898] {CVE-2024-27434} - misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspend/resume (Steve Best) [RHEL-36932] {CVE-2024-35824} - [rt] build kernel-rt-4.18.0-553.9.1.rt7.350.el8_10 [RHEL-44553] - x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (Steve Best) [RHEL-37262] {CVE-2024-35876} - net/sched: flower: Fix chain template offload (Xin Long) [RHEL-31313] {CVE-2024-26669} - SUNRPC: fix a memleak in gss_import_v2_context (Scott Mayhew) [RHEL-35195] {CVE-2023-52653} - efivarfs: force RO when remounting if SetVariable is not supported (Pavel Reichl) [RHEL-26564] {CVE-2023-52463} - dmaengine: idxd: add a write() method for applications to submit work (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823} - dmaengine: idxd: add a new security check to deal with a hardware erratum (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823} - VFIO: Add the SPR_DSA and SPR_IAX devices to the denylist (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823} - quota: Fix potential NULL pointer dereference (Pavel Reichl) [RHEL-33219] {CVE-2024-26878} - locking/lockdep: Fix overflow in presentation of average lock-time (Čestmír Kalina) [RHEL-17678] - blk-cgroup: Properly propagate the iostat update up the hierarchy (Ming Lei) [RHEL-40939] - proc: Use new_inode not new_inode_pseudo (Ian Kent) [RHEL-40167] - stmmac: Clear variable when destroying workqueue (Izabela Bakollari) [RHEL-31822] {CVE-2024-26802} - powerpc/pseries/memhp: Fix access beyond end of drmem array (Mamatha Inamdar) [RHEL-26495] {CVE-2023-52451} - platform/x86: wmi: Fix opening of char device (David Arcari) [RHEL-38258] {CVE-2023-52864} - Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" (Kamal Heib) [RHEL-36908] {CVE-2023-52658} - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed (Cathy Avery) [RHEL-39074] - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove (Cathy Avery) [RHEL-39074] - hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes (Cathy Avery) [RHEL-39074] - hv_netvsc: remove duplicated including of slab.h (Cathy Avery) [RHEL-39074] - hv_netvsc: rndis_filter needs to select NLS (Cathy Avery) [RHEL-39074] - hv_netvsc: Mark VF as slave before exposing it to user-mode (Cathy Avery) [RHEL-39074] - hv_netvsc: Fix race of register_netdevice_notifier and VF register (Cathy Avery) [RHEL-39074] - hv_netvsc: fix race of netvsc and VF register_netdevice (Cathy Avery) [RHEL-39074] - hv_netvsc: fix netvsc_send_completion to avoid multiple message length checks (Cathy Avery) [RHEL-39074] - hv_netvsc: Allocate rx indirection table size dynamically (Cathy Avery) [RHEL-39074] - net: hv_netvsc: Fix a warning triggered by memcpy in rndis_filter (Cathy Avery) [RHEL-39074] - gfs2: Fix lru_count accounting (Andreas Gruenbacher) [RHEL-32941] - gfs2: Fix "Make glock lru list scanning safer" (Andreas Gruenbacher) [RHEL-32941] - gfs2: Fix "ignore unlock failures after withdraw" (Andreas Gruenbacher) [RHEL-32941] - gfs2: Don't set GLF_LOCK in gfs2_dispose_glock_lru (Andreas Gruenbacher) [RHEL-32941] - gfs2: Don't forget to complete delayed withdraw (Andreas Gruenbacher) [RHEL-32941] - gfs2: Delay withdraw from atomic context (Andreas Gruenbacher) [RHEL-32941] - gfs2: trivial clean up of gfs2_ail_error (Andreas Gruenbacher) [RHEL-32941] - ext4: fix corruption during on-line resize (Carlos Maiolino) [RHEL-36974] {CVE-2024-35807} - ext4: correct offset of gdb backup in non meta_bg group to update_backups (Carlos Maiolino) [RHEL-36974] - ext4: avoid online resizing failures due to oversized flex bg (Carlos Maiolino) [RHEL-30507] {CVE-2023-52622} - ext4: use time_is_before_jiffies() instead of open coding it (Carlos Maiolino) [RHEL-30507] - ext4: unify the type of flexbg_size to unsigned int (Carlos Maiolino) [RHEL-30507] - ext4: remove unnecessary check from alloc_flex_gd() (Carlos Maiolino) [RHEL-30507] - tracing: Do no increment trace_clock_global() by one (Jerome Marchand) [RHEL-27107] {CVE-2021-46939} - tracing: Restructure trace_clock_global() to never block (Jerome Marchand) [RHEL-27107] {CVE-2021-46939} - net/sched: act_skbmod: prevent kernel-infoleak (Xin Long) [RHEL-37220] {CVE-2024-35893} - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (Xin Long) [RHEL-38307] {CVE-2023-52845} - redhat: remove the merge subtrees script (Derek Barbosa) - redhat: rhdocs: delete .get_maintainer.conf (Derek Barbosa) - redhat: rhdocs: Remove the rhdocs directory (Derek Barbosa) - dyndbg: fix old BUG_ON in >control parser (Waiman Long) [RHEL-37111] {CVE-2024-35947} - dyndbg: let query-modname override actual module name (Waiman Long) [RHEL-37111] - dyndbg: make dyndbg a known cli param (Waiman Long) [RHEL-37111] - lan78xx: Fix exception on link speed change (Jamie Bainbridge) [RHEL-33437] - net: usb: lan78xx: don't modify phy_device state concurrently (Jamie Bainbridge) [RHEL-33437] - efi: runtime: Fix potential overflow of soft-reserved region size (Lenny Szubowicz) [RHEL-33096] {CVE-2024-26843} - perf/arm-cmn: Fail DTC counter allocation correctly (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Rework DTC counters (again) (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Fix DTC domain detection (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Revamp model detection (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Fix port detection for CMN-700 (Michael Petlan) [RHEL-23841] - perf/arm-cmn: Move overlapping wp_combine field (Michael Petlan) [RHEL-23841] - Partially revert "perf/arm-cmn: Optimise DTC counter accesses" (Michael Petlan) [RHEL-23841] - drivers/perf: Compile with gnu99 standard (Michael Petlan) [RHEL-23841] - x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (Steve Best) [RHEL-36994] {CVE-2024-35801} - watchdog: softdog: Add options 'soft_reboot_cmd' and 'soft_active_on_boot' (Waiman Long) [RHEL-19723] - tipc: fix UAF in error path (Xin Long) [RHEL-34278] {CVE-2024-36886} - [rt] build kernel-rt-4.18.0-553.8.1.rt7.349.el8_10 [RHEL-40882] - udf: Fix NULL pointer dereference in udf_symlink function (Pavel Reichl) [RHEL-37769] {CVE-2021-47353} - net: ti: fix UAF in tlan_remove_one (Jose Ignacio Tornos Martinez) [RHEL-38940] {CVE-2021-47310} - ARM: footbridge: fix PCI interrupt mapping (Myron Stowe) [RHEL-26971] {CVE-2021-46909} - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (Kamal Heib) [RHEL-37454] {CVE-2024-36004} - net/mlx5e: Fix mlx5e_priv_init() cleanup flow (Kamal Heib) [RHEL-37424] {CVE-2024-35959} - net/mlx5: Properly link new fs rules into the tree (Kamal Heib) [RHEL-37420] {CVE-2024-35960} - net/mlx5e: fix a potential double-free in fs_any_create_groups (Kamal Heib) [RHEL-37091] {CVE-2023-52667} - net: ena: Fix incorrect descriptor free behavior (Kamal Heib) [RHEL-37428] {CVE-2024-35958} - mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - mISDN: fix possible use-after-free in HFC_cleanup() (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - implement dh fallback for primes > 4K (Vladis Dronov) [RHEL-35106] - crypto: qat - avoid division by zero (Vladis Dronov) [RHEL-35106] - crypto: qat - resolve race condition during AER recovery (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - use kcalloc_node() instead of kzalloc_node() (Vladis Dronov) [RHEL-35106] - [rt] Enable CONFIG_DRM_MGAG200_DISABLE_WRITECOMBINE (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Add an option to disable Write-Combine (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Fix caching setup for remapped video memory (Jocelyn Falempe) [RHEL-36172] - Revert "drm/mgag200: Add a workaround for low-latency" (Jocelyn Falempe) [RHEL-36172] - mptcp: fix data re-injection from stale subflow (Davide Caratti) [RHEL-33133] {CVE-2024-26826} - ipv6: sr: fix incorrect unregister order (Hangbin Liu) [RHEL-31730] - ipv6: sr: fix possible use-after-free and null-ptr-deref (Hangbin Liu) [RHEL-31730] {CVE-2024-26735} - net/bnx2x: Prevent access to a freed page in page_pool (Michal Schmidt) [RHEL-14195 RHEL-33243] {CVE-2024-26859} - bnx2x: new flag for track HW resource allocation (Michal Schmidt) [RHEL-14195 RHEL-33243] - bnx2x: fix page fault following EEH recovery (Michal Schmidt) [RHEL-14195 RHEL-33243] - x86: KVM: SVM: always update the x2avic msr interception (Maxim Levitsky) [RHEL-15495] {CVE-2023-5090} - EDAC/thunderx: Fix possible out-of-bounds string access (Aristeu Rozanski) [RHEL-26573] {CVE-2023-52464} - [rt] build kernel-rt-4.18.0-553.7.1.rt7.348.el8_10 [RHEL-34640] - net: qcom/emac: fix UAF in emac_remove (Ken Cox) [RHEL-37834] {CVE-2021-47311} - perf/core: Bail out early if the request AUX area is out of bound (Michael Petlan) [RHEL-38268] {CVE-2023-52835} - crypto: pcrypt - Fix hungtask for PADATA_RESET (Herbert Xu) [RHEL-38171] {CVE-2023-52813} - drm/amdgpu: fix use-after-free bug (Jocelyn Falempe) [RHEL-31240] {CVE-2024-26656} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash (Ivan Vecera) [RHEL-37008] {CVE-2024-35854} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update (Ivan Vecera) [RHEL-37004] {CVE-2024-35855} - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (Ivan Vecera) [RHEL-37012] {CVE-2024-35853} - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work (Ivan Vecera) [RHEL-37016] {CVE-2024-35852} - mlxsw: spectrum_acl_tcam: Fix warning during rehash (Ivan Vecera) [RHEL-37480] {CVE-2024-36007} - can: peak_pci: peak_pci_remove(): fix UAF (Jose Ignacio Tornos Martinez) [RHEL-38419] {CVE-2021-47456} - usbnet: fix error return code in usbnet_probe() (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - usbnet: sanity check for maxpacket (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - net/mlx5e: fix a double-free in arfs_create_groups (Kamal Heib) [RHEL-36920] {CVE-2024-35835} - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds (Jose Ignacio Tornos Martinez) [RHEL-38220] {CVE-2023-52878} - net: cdc_eem: fix tx fixup skb leak (Jose Ignacio Tornos Martinez) [RHEL-38080] {CVE-2021-47236} - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Jose Ignacio Tornos Martinez) [RHEL-38113] {CVE-2023-52703} - usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() (Desnes Nunes) [RHEL-38248] {CVE-2023-52877} - usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (Desnes Nunes) [RHEL-38240] {CVE-2023-52781} - gro: fix ownership transfer (Xin Long) [RHEL-37226] {CVE-2024-35890} - tipc: fix kernel warning when sending SYN message (Xin Long) [RHEL-38109] {CVE-2023-52700} - erspan: make sure erspan_base_hdr is present in skb->head (Xin Long) [RHEL-37230] {CVE-2024-35888} - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() (Bryan Gurney) [RHEL-17366] - scsi: mpi3mr: Sanitise num_phys (Bryan Gurney) [RHEL-17366] - netfilter: nf_tables: use timestamp to check for set element timeout (Phil Sutter) [RHEL-38023] {CVE-2024-27397} - net/ipv6: SKB symmetric hash should incorporate transport ports (Sabrina Dubroca) [RHEL-32061] - crypto: s390/aes - Fix buffer overread in CTR mode (Herbert Xu) [RHEL-37089] {CVE-2023-52669} - net: Save and restore msg_namelen in sock_sendmsg (Jamie Bainbridge) [RHEL-35893] - net: prevent address rewrite in kernel_bind() (Jamie Bainbridge) [RHEL-35893] - net: prevent rewrite of msg_name in sock_sendmsg() (Jamie Bainbridge) [RHEL-35893] - net: replace calls to sock->ops->connect() with kernel_connect() (Jamie Bainbridge) [RHEL-35893] - net: Avoid address overwrite in kernel_connect (Jamie Bainbridge) [RHEL-35893] - wifi: iwlwifi: dbg-tlv: ensure NUL termination (Jose Ignacio Tornos Martinez) [RHEL-37026] {CVE-2024-35845} - wifi: mac80211: fix potential sta-link leak (Jose Ignacio Tornos Martinez) [RHEL-36916] {CVE-2024-35838} - wifi: nl80211: reject iftype change with mesh ID change (Jose Ignacio Tornos Martinez) [RHEL-36884] {CVE-2024-27410} - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (Jose Ignacio Tornos Martinez) [RHEL-36807] {CVE-2024-35789} - Bluetooth: Avoid potential use-after-free in hci_error_reset (David Marlin) [RHEL-31826] {CVE-2024-26801} - tls: disable async encrypt/decrypt (Sabrina Dubroca) [RHEL-26362 RHEL-26409 RHEL-26420] {CVE-2024-26585 CVE-2024-26583 CVE-2024-26584} - Squashfs: check the inode number is not the invalid value of zero (Phillip Lougher) [RHEL-35096] {CVE-2024-26982} - ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/msg.c: update and document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/sem.c: document and update memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: update/document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: remove duplicated code (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (Kamal Heib) [RHEL-30582] {CVE-2023-52626} - Revert "ACPI: bus: Rework system-level device notification handling" (Prarit Bhargava) [RHEL-21486] - hwrng: core - Fix page fault dead lock on mmap-ed hwrng (Prarit Bhargava) [RHEL-29485] {CVE-2023-52615} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - iio: event: Fix event FIFO reset race (CKI Backport Bot) [RHEL-223364] {CVE-2026-64496} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-188270] - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-188270] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188786] {CVE-2025-54518} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991} - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136} - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374} - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556] - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523} - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997] - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320} - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189} - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400] - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088] - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924} - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388} - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767] - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767] - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888} - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991} - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546] - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546] - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581} - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144] - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144] - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492] - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492] - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970} - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - EDAC/bluefield: Fix potential integer overflow (Joel Savitz) [RHEL-234337] {CVE-2024-53161} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254583] {CVE-2026-74556} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230276] {CVE-2026-63802} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244942] {CVE-2026-72098} - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Jose Ignacio Tornos Martinez) [RHEL-237990] {CVE-2026-68363} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231677] {CVE-2026-64117} - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jose Ignacio Tornos Martinez) [RHEL-230705] {CVE-2025-71127} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230593] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229715] {CVE-2026-52947} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228708] {CVE-2026-63889} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189455] {CVE-2026-43133} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096] {CVE-2026-72298} - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228} - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103} - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-227976] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122] {CVE-2026-46266} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge) [RHEL-227265] {CVE-2026-64002} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981] {CVE-2026-53075} - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057] {CVE-2026-53275} - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223} - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595] {CVE-2026-43339} - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143} - slip: not call free_netdev before rtnl_unlock in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix use-after-free Read in slip_open (Michal Schmidt) [RHEL-237390] - slip: Fix memory leak in slip_open error path (Michal Schmidt) [RHEL-237390] - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663] {CVE-2026-53131} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607] {CVE-2026-43233} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832] {CVE-2026-52920} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240] {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191599] {CVE-2026-53176} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534} - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534} - xfs: do not allocate the entire delalloc extent in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: fix xfs_bmap_add_extent_delay_real for partial conversions (Lukas Herbolt) [RHEL-251578] - xfs: remove the xfs_iext_peek_prev_extent call in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: pass the actual offset and len to allocate to xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: don't open code XFS_FILBLKS_MIN in xfs_bmapi_write (Lukas Herbolt) [RHEL-251578] - xfs: lift a xfs_valid_startblock into xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - xfs: remove the unusued tmp_logflags variable in xfs_bmapi_allocate (Lukas Herbolt) [RHEL-251578] - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823} - iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() (Jakub Brnak) [RHEL-243217] - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475] {CVE-2026-45894} - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450] {CVE-2026-53053} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787] {CVE-2026-68293} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181] {CVE-2026-46043} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810] {CVE-2026-53062} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060] {CVE-2026-63947} - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747] {CVE-2026-63975} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227528] {CVE-2026-43334} - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918} - Bluetooth: btusb: revert use of devm_kzalloc in btusb (CKI Backport Bot) [RHEL-225154] {CVE-2025-71082} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205] {CVE-2025-39964} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - powerpc/pseries: pci - logic bug (Mamatha Inamdar) [RHEL-240146] - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228} - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899] {CVE-2026-90036} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680] {CVE-2026-72262} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641} - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781] {CVE-2026-74583} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916] {CVE-2026-68377} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269] {CVE-2026-31566} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571] {CVE-2026-89846} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620] {CVE-2026-72261} - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030] {CVE-2026-63831} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282] {CVE-2026-64564} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216297] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271288] {CVE-2026-89631} - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280060] {CVE-2026-98320} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271853] {CVE-2026-93817} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191034] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191034] {CVE-2026-53196} - gfs2: a minor finish_xmote cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor run_queue fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: only apply DLM_LKF_VALBLK if sb_lvbptr is not NULL (Alexander Aring) [RHEL-129363] - gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Use wait_event_freezable_timeout() for freezable kthread (Andreas Gruenbacher) [RHEL-129363] - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-129363] - gfs2: low-memory forced flush fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: add missing withdraw locking (Andreas Gruenbacher) [RHEL-129363] - gfs2: Disable GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename "gfs_recovery" workqueue to "gfs2_recovery" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-129363] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-129363] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify do_promote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-129363] - gfs2: introduce new gfs2_glock_assert_withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify refcounting in do_xmote (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Make recovery error more readable (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark the remaining process-independent glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark flock glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of newlines in log messages (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-129363] - gfs2: Sanitize kthread stopping (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix logd wakeup on I/O error (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_quotad (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_logd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove duplicate check in do_xmote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove space before newline (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix LM_FLAG_TRY* logic in add_to_queue (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove DLM_LKF_ALTCW / DLM_LKF_ALTPR code (Andreas Gruenbacher) [RHEL-129363] - gfs2: Further sanitize lock_dlm.c (Andreas Gruenbacher) [RHEL-129363] - gfs2: sanitize the gdlm_ast -> finish_xmote interface (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify DLM_LKF_QUECVT use (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-129363] - gfs2: Lift withdraw check out of gfs2_ail1_empty (Andreas Gruenbacher) [RHEL-129363] - gfs2: don't withdraw if init_threads() got interrupted (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-129363] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix slab-use-after-free in gfs2_qd_dealloc (Andreas Gruenbacher) [RHEL-129363] {CVE-2023-52760} - gfs2: Fix asynchronous thread destruction (Andreas Gruenbacher) [RHEL-129363] - gfs2: Stop using gfs2_make_fs_ro for withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-129363] - gfs2: Turn gfs2_withdraw into a void function (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark withdraws as unlikely (Andreas Gruenbacher) [RHEL-129363] - gfs2: ignore rindex_update failure in dinode_dealloc (Andreas Gruenbacher) [RHEL-129363] - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270732] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256684] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256684] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256684] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271657] {CVE-2026-93288} - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254282] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-263292] {CVE-2026-89479} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254357] {CVE-2026-74588} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222954] {CVE-2026-52935} - powerpc/pseries: pci - logic bug (Mamatha Inamdar) [RHEL-240146] - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228} - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899] {CVE-2026-90036} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680] {CVE-2026-72262} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641} - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781] {CVE-2026-74583} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916] {CVE-2026-68377} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556} - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273} - drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710] - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204} - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024] - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270905] {CVE-2026-89777} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263644] {CVE-2026-68202} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254200] {CVE-2026-80590} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233134] {CVE-2026-64572} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225459] {CVE-2026-64114} - xfs: bounds-check buffer log item's dirty bitmap (CKI Backport Bot) [RHEL-253365] {CVE-2026-80536} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234242] {CVE-2026-64266} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271288] {CVE-2026-89631} - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280060] {CVE-2026-98320} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271853] {CVE-2026-93817} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191034] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191034] {CVE-2026-53196} - gfs2: a minor finish_xmote cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor run_queue fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: only apply DLM_LKF_VALBLK if sb_lvbptr is not NULL (Alexander Aring) [RHEL-129363] - gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Use wait_event_freezable_timeout() for freezable kthread (Andreas Gruenbacher) [RHEL-129363] - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-129363] - gfs2: low-memory forced flush fixes (Andreas Gruenbacher) [RHEL-129363] - gfs2: add missing withdraw locking (Andreas Gruenbacher) [RHEL-129363] - gfs2: Disable GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename "gfs_recovery" workqueue to "gfs2_recovery" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-129363] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-129363] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-129363] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-129363] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify do_promote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-129363] - gfs2: introduce new gfs2_glock_assert_withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify refcounting in do_xmote (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Make recovery error more readable (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-129363] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-129363] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-129363] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark the remaining process-independent glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark flock glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of newlines in log messages (Andreas Gruenbacher) [RHEL-129363] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-129363] - gfs2: Sanitize kthread stopping (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix logd wakeup on I/O error (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_quotad (Andreas Gruenbacher) [RHEL-129363] - gfs2: Switch to wait_event in gfs2_logd (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove duplicate check in do_xmote (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove space before newline (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix LM_FLAG_TRY* logic in add_to_queue (Andreas Gruenbacher) [RHEL-129363] - gfs2: Remove DLM_LKF_ALTCW / DLM_LKF_ALTPR code (Andreas Gruenbacher) [RHEL-129363] - gfs2: Further sanitize lock_dlm.c (Andreas Gruenbacher) [RHEL-129363] - gfs2: sanitize the gdlm_ast -> finish_xmote interface (Andreas Gruenbacher) [RHEL-129363] - gfs2: Simplify DLM_LKF_QUECVT use (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-129363] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-129363] - gfs2: Lift withdraw check out of gfs2_ail1_empty (Andreas Gruenbacher) [RHEL-129363] - gfs2: don't withdraw if init_threads() got interrupted (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-129363] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Fix slab-use-after-free in gfs2_qd_dealloc (Andreas Gruenbacher) [RHEL-129363] {CVE-2023-52760} - gfs2: Fix asynchronous thread destruction (Andreas Gruenbacher) [RHEL-129363] - gfs2: Stop using gfs2_make_fs_ro for withdraw (Andreas Gruenbacher) [RHEL-129363] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-129363] - gfs2: Turn gfs2_withdraw into a void function (Andreas Gruenbacher) [RHEL-129363] - gfs2: Mark withdraws as unlikely (Andreas Gruenbacher) [RHEL-129363] - gfs2: ignore rindex_update failure in dinode_dealloc (Andreas Gruenbacher) [RHEL-129363] - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270732] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256684] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256684] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256684] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271657] {CVE-2026-93288} - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254282] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-263292] {CVE-2026-89479} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254357] {CVE-2026-74588} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222954] {CVE-2026-52935} - powerpc/pseries: pci - logic bug (Mamatha Inamdar) [RHEL-240146] - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228} - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899] {CVE-2026-90036} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680] {CVE-2026-72262} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641} - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781] {CVE-2026-74583} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916] {CVE-2026-68377} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108] {CVE-2026-89811} - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131] {CVE-2026-80887} - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877] {CVE-2026-68108} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862] {CVE-2026-68278} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371] {CVE-2026-63920} - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318} - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (Timothy Redaelli) [RHEL-253844] {CVE-2026-31678} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530} - packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539] - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539] - packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582} - net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539] - net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115} - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227} - s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199] - s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194] - s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194] - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829} - net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023] - net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023] - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994} - NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393] - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746} - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048} - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049} - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242} - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994} - media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646] - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861} - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794} - keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349] - Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099} - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329} - liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368] - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102} - [rt] build kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 [RHEL-53529] - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071} - [rt] build kernel-rt-4.18.0-553.21.1.rt7.362.el8_10 [RHEL-53529] - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874] - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558} - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441} - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904} - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322} - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246} - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008} - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228} - [rt] build kernel-rt-4.18.0-553.20.1.rt7.361.el8_10 [RHEL-53529] - KVM: arm64: Disassociate vcpus from redistributor region on teardown (Shaoqin Huang) [RHEL-48417] {CVE-2024-40989} - devres: Fix memory leakage caused by driver API devm_free_percpu() (CKI Backport Bot) [RHEL-55597] {CVE-2024-43871} - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (Izabela Bakollari) [RHEL-26680] {CVE-2024-26600} - nvmet-fc: avoid deadlock on delete association path (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - nvmet-fc: release reference on target port (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - ACPI: LPIT: Avoid u32 multiplication overflow (Mark Langsdorf) [RHEL-37062] {CVE-2023-52683} - sched/deadline: Fix task_struct reference leak (Phil Auld) [RHEL-50904] {CVE-2024-41023} - nfsd: fix crash on LOCKT on reexported NFSv3 (Benjamin Coddington) [RHEL-31515] - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path (CKI Backport Bot) [RHEL-26570] {CVE-2024-26595} - mlxsw: spectrum_acl_tcam: Move devlink param to TCAM code (Ivan Vecera) [RHEL-26570] {CVE-2024-26595} - ACPI: extlog: fix NULL pointer dereference check (Mark Langsdorf) [RHEL-29110] {CVE-2023-52605} - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() (Mark Langsdorf) [RHEL-33198] {CVE-2024-26894} - mm: prevent derefencing NULL ptr in pfn_section_valid() (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - mm, kmsan: fix infinite recursion due to RCU critical section (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - cipso: make cipso_v4_skbuff_delattr() fully remove the CIPSO options (Ondrej Mosnacek) [RHEL-30904] - cipso: fix total option length computation (Ondrej Mosnacek) [RHEL-30904] - ext4: do not create EA inode under buffer lock (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: check the return value of ext4_xattr_inode_dec_ref() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (Carlos Maiolino) [RHEL-48507] {CVE-2024-40998} - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - [rt] build kernel-rt-4.18.0-553.19.1.rt7.360.el8_10 [RHEL-53529] - drm/i915/vma: Fix UAF on destroy against retire race (Mika Penttilä) [RHEL-35222] {CVE-2024-26939} - RHEL-48620 (Kenneth Yin) [RHEL-48620] - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (CKI Backport Bot) [RHEL-42721] {CVE-2024-26855} - net: usb: asix: do not force pause frames support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix "can't send until first packet is send" issue (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix modprobe "sysfs: cannot create duplicate filename" (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: add proper error handling of usb read errors (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix wrong return value in asix_check_host_enable() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix uninit-value in asix_mdio_read() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: fix boolconv.cocci warnings (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: do not call phy_disconnect() for ax88178 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: move embedded PHY detection as early as possible (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix uninit value bugs (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add missing stop (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: suspend PHY on driver probe (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: manage PHY PM from MAC (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: add error handling for asix_mdio_* functions (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add phylib support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: refactor asix_read_phy_addr() and handle errors on return (Ken Cox) [RHEL-28108] {CVE-2021-47101} - SUNRPC: always free ctxt when freeing deferred request (Jay Shin) [RHEL-40936] - SUNRPC: double free xprt_ctxt while still in use (Jay Shin) [RHEL-40936] - SUNRPC: Remove svc_rqst::rq_xprt_hlen (Jay Shin) [RHEL-40936] - SUNRPC: Remove dead code in svc_tcp_release_rqst() (Jay Shin) [RHEL-40936] - x86/bugs: Extend VMware Retbleed workaround to Nehalem & earlier CPUs (Waiman Long) [RHEL-48646] - wifi: iwlwifi: read txq->read_ptr under lock (Jose Ignacio Tornos Martinez) [RHEL-39797] {CVE-2024-36922} - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (John Meneghini) [RHEL-39908] {CVE-2024-36919} - nbd: always initialize struct msghdr completely (Ming Lei) [RHEL-29498] {CVE-2024-26638} - block: don't call rq_qos_ops->done_bio if the bio isn't tracked (Ming Lei) [RHEL-42151] {CVE-2021-47412} - nvmet: fix a possible leak when destroy a ctrl during qp establishment (Maurizio Lombardi) [RHEL-52013] {CVE-2024-42152} - ipv6: prevent NULL dereference in ip6_output() (Sabrina Dubroca) [RHEL-39912] {CVE-2024-36901} - ppp: reject claimed-as-LCP but actually malformed packets (Guillaume Nault) [RHEL-51052] {CVE-2024-41044} - leds: trigger: Unregister sysfs attributes before calling deactivate() (CKI Backport Bot) [RHEL-54834] {CVE-2024-43830} - crypto: bcm - Fix pointer arithmetic (cki-backport-bot) [RHEL-44108] {CVE-2024-38579} - scsi: qedf: Ensure the copied buf is NUL terminated (John Meneghini) [RHEL-44195] {CVE-2024-38559} - x86/bhi: Avoid warning in #DB handler due to BHI mitigation (Waiman Long) [RHEL-53657] {CVE-2024-42240} - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (CKI Backport Bot) [RHEL-47529] {CVE-2024-40901} - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (CKI Backport Bot) [RHEL-39843] {CVE-2024-36902} - net: usb: ax88179_178a: improve link status logs (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: improve reset check (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: fix link status when link is set to down/up (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: avoid writing the mac address before first reading (Jose Ignacio Tornos Martinez) [RHEL-45167] - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - media: cec: cec-api: add locking in cec_release() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid confusing "transmit timed out" message (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid recursive cec_claim_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: remove length check of Timer Status (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: count low-drive, error and arb-lost conditions (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add note about *_from_edid() function usage in drm (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_unconfigured() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_nb_transmit_canceled() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: don't set last_initiator if tx in progress (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: disable adapter in cec_devnode_unregister (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: not all messages were passed on when monitoring (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add support for Absolute Volume Control (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: log when claiming LA fails unexpectedly (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: drop activate_cnt, use state info instead (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: reconfigure if the PA changes during configuration (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: fix is_configuring state (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: stop trying LAs on CEC_TX_STATUS_TIMEOUT (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't unconfigure if already unconfigured (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add optional adap_configured callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add xfer_timeout_ms field (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: use call_op and check for !unregistered (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix interrupt en/disable handling (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: drop unused 'enabled' field from struct cec_pin (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix off-by-one SFT check (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: rename timer overrun variables (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: correctly pass on reply results (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: abort if the current transmit was canceled (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: call enable_adap on s_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: media/cec.h: document cec_adapter fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix a deadlock situation (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: safely unhook lists in cec_data (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: copy sequence field for the reply (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix trivial style warnings (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: add 'unregistered' checks (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't use flush_scheduled_work() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: Use fallthrough pseudo-keyword (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: remove unused waitq and phys_addrs fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: silence shift wrapping warning in __cec_s_log_addrs() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: move the core to a separate directory (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - net/iucv: Avoid explicit cpumask var allocation on stack (CKI Backport Bot) [RHEL-51631] {CVE-2024-42094} - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (Dick Kennedy) [RHEL-40400] - KVM: selftests: Make hyperv_clock require TSC based system clocksource (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Run clocksource dependent tests with hyperv_clocksource_tsc_page too (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Use generic sys_clocksource_is_tsc() in vmx_nested_tsc_scaling_test (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Generalize check_clocksource() from kvm_clock_test (Vitaly Kuznetsov) [RHEL-19027] - firmware: cs_dsp: Return error if block header overflows file (CKI Backport Bot) [RHEL-53646] {CVE-2024-42238} - firmware: cs_dsp: Validate payload length before processing block (CKI Backport Bot) [RHEL-53638] {CVE-2024-42237} - mm, slub: fix potential memoryleak in kmem_cache_open() (Waiman Long) [RHEL-38404] {CVE-2021-47466} - slub: don't panic for memcg kmem cache creation failure (Waiman Long) [RHEL-38404] {CVE-2021-47466} - wifi: ath11k: fix htt pktlog locking (Jose Ignacio Tornos Martinez) [RHEL-38317] {CVE-2023-52800} - wifi: ath11k: fix dfs radar event locking (Jose Ignacio Tornos Martinez) [RHEL-38165] {CVE-2023-52798} - lib/generic-radix-tree.c: Don't overflow in peek() (Waiman Long) [RHEL-37737] {CVE-2021-47432} - include/linux/generic-radix-tree.h: replace kernel.h with the necessary inclusions (Waiman Long) [RHEL-37737] {CVE-2021-47432} - EDAC/i10nm: Skip the absent memory controllers (Aristeu Rozanski) [RHEL-43236] - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (John Meneghini) [RHEL-38197] {CVE-2023-52809} - gfs2: Fix potential glock use-after-free on unmount (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: simplify gdlm_put_lock with out_free label (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: Remove ill-placed consistency check (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - nvme-fc: do not wait in vain when unloading module (Ewan D. Milne) [RHEL-33083] {CVE-2024-26846} - HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts (CKI Backport Bot) [RHEL-49698] {CVE-2022-48866} - scsi: qedf: Set qed_slowpath_params to zero before use (John Meneghini) [RHEL-9797] - scsi: qedf: Wait for stag work during unload (John Meneghini) [RHEL-9797] - scsi: qedf: Don't process stag work during unload and recovery (John Meneghini) [RHEL-9797] - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - mm: avoid overflows in dirty throttling logic (Audra Mitchell) [RHEL-51840] {CVE-2024-42131} - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - ACPI: fix NULL pointer dereference (Mark Langsdorf) [RHEL-37897] {CVE-2021-47289} - [rt] build kernel-rt-4.18.0-553.18.1.rt7.359.el8_10 [RHEL-53529] - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING (Ewan D. Milne) [RHEL-39805] {CVE-2024-36920} - tun: limit printing rate when illegal packet received by tun dev (Jon Maloy) [RHEL-35046] {CVE-2024-27013} - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu/mes: fix use-after-free issue (Michel Dänzer) [RHEL-44043] {CVE-2024-38581} - drm/amdgpu: Fix the null pointer when load rlc firmware (Michel Dänzer) [RHEL-30603] {CVE-2024-26649} - drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (Michel Dänzer) [RHEL-35160] {CVE-2024-27042} - net/sched: Fix UAF when resolving a clash (Xin Long) [RHEL-51014] {CVE-2024-41040} - tcp_metrics: validate source addr length (Guillaume Nault) [RHEL-52025] {CVE-2024-42154} - NFSv4/pnfs: Fix a use-after-free bug in open (Benjamin Coddington) [RHEL-35508] - NFSv4: Don't hold the layoutget locks across multiple RPC calls (Benjamin Coddington) [RHEL-35508] - scsi: qedf: Make qedf_execute_tmf() non-preemptible (John Meneghini) [RHEL-51799] {CVE-2024-42124} - Input: elantech - fix stack out of bound access in elantech_change_report_id() (CKI Backport Bot) [RHEL-41938] {CVE-2021-47097} - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (CKI Backport Bot) [RHEL-28982] {CVE-2023-52478} - drm/radeon: fix UBSAN warning in kv_dpm.c (CKI Backport Bot) [RHEL-48399] {CVE-2024-40988} - usb: core: Don't hold the device lock while sleeping in do_proc_control() (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - USB: core: Make do_proc_control() and do_proc_bulk() killable (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - scsi: qedi: Fix crash while reading debugfs attribute (CKI Backport Bot) [RHEL-48327] {CVE-2024-40978} - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CKI Backport Bot) [RHEL-48309] {CVE-2024-40977} - net: tcp: accept old ack during closing (Jamie Bainbridge) [RHEL-52433] - wifi: iwlwifi: mvm: don't read past the mfuart notifcation (CKI Backport Bot) [RHEL-48016] {CVE-2024-40941} - net/iucv: fix use after free in iucv_sock_close() (Mete Durlu) [RHEL-53988] - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (CKI Backport Bot) [RHEL-47908] {CVE-2024-40929} - Input: aiptek - properly check endpoint type (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - use descriptors of current altsetting (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - fix endpoint sanity check (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB (CKI Backport Bot) [RHEL-52373] {CVE-2024-42226} - wifi: mt76: replace skb_put with skb_put_zero (CKI Backport Bot) [RHEL-52366] {CVE-2024-42225} - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (CKI Backport Bot) [RHEL-47776] {CVE-2024-40912} - wifi: cfg80211: Lock wiphy in cfg80211_get_station (CKI Backport Bot) [RHEL-47758] {CVE-2024-40911} - VMCI: Use struct_size() in kmalloc() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() (Steve Best) [RHEL-37325] {CVE-2024-35944} - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values (Jose Ignacio Tornos Martinez) [RHEL-51761] {CVE-2024-42114} - usb: atm: cxacru: fix endpoint checking in cxacru_bind() (CKI Backport Bot) [RHEL-51442] {CVE-2024-41097} - nfs: handle error of rpc_proc_register() in init_nfs_fs() (Scott Mayhew) [RHEL-39904] {CVE-2024-36939} - drm/radeon: check bo_va->bo is non-NULL before using it (CKI Backport Bot) [RHEL-51184] {CVE-2024-41060} - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). (CKI Backport Bot) [RHEL-51027] {CVE-2024-41041} - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (CKI Backport Bot) [RHEL-50961] {CVE-2024-41035} - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). (CKI Backport Bot) [RHEL-44408] {CVE-2024-37356} - tcp: avoid too many retransmit packets (Florian Westphal) [RHEL-48627] {CVE-2024-41007} - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() (Florian Westphal) [RHEL-48627] - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Florian Westphal) [RHEL-48627] - tcp: refactor tcp_retransmit_timer() (Florian Westphal) [RHEL-48627] - tcp: exit if nothing to retransmit on RTO timeout (Florian Westphal) [RHEL-48627] - netfilter: nf_tables: Reject tables of unsupported family (Florian Westphal) [RHEL-21418] {CVE-2023-6040} - [rt] build kernel-rt-4.18.0-553.17.1.rt7.358.el8_10 [RHEL-53529] - kyber: fix out of bounds access when preempted (Ming Lei) [RHEL-27258] {CVE-2021-46984} - vfs: don't mod negative dentry count when on shrinker list (Brian Foster) [RHEL-35874] - fs/dcache: Re-use value stored to dentry->d_flags instead of re-reading (Brian Foster) [RHEL-35874] - fbmem: Do not delete the mode that is still in use (CKI Backport Bot) [RHEL-37796] {CVE-2021-47338} - netpoll: Fix race condition in netpoll_owner_active (CKI Backport Bot) [RHEL-49361] {CVE-2024-41005} - firmware: arm_scpi: Fix string overflow in SCPI genpd driver (Mark Salter) [RHEL-43702] {CVE-2021-47609} - ipv6: prevent possible NULL dereference in rt6_probe() (Guillaume Nault) [RHEL-48149] {CVE-2024-40960} - HID: i2c-hid-of: fix NULL-deref on failed power up (CKI Backport Bot) [RHEL-31598] {CVE-2024-26717} - cpufreq: amd-pstate: fix memory leak on CPU EPP exit (CKI Backport Bot) [RHEL-48489] {CVE-2024-40997} - x86/mm/pat: fix VM_PAT handling in COW mappings (Chris von Recklinghausen) [RHEL-37258] {CVE-2024-35877} - PCI/PM: Drain runtime-idle callbacks before driver removal (Myron Stowe) [RHEL-42937] {CVE-2024-35809} - PCI: Drop pci_device_remove() test of pci_dev->driver (Myron Stowe) [RHEL-42937] {CVE-2024-35809} - drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() (Mika Penttilä) [RHEL-26909] {CVE-2023-52470} - USB: core: Fix hang in usb_kill_urb by adding memory barriers (Desnes Nunes) [RHEL-43979] {CVE-2022-48760} - cifs: fix bad fids sent over wire (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB311_posix_mkdir (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB2_tcon (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB2_open (Paulo Alcantara) [RHEL-52517] - smb3: add additional null check in SMB2_ioctl (Paulo Alcantara) [RHEL-52517] - selftests: forwarding: devlink_lib: Wait for udev events after reloading (Mark Langsdorf) [RHEL-47642] {CVE-2024-39501} - drivers: core: synchronize really_probe() and dev_uevent() (Mark Langsdorf) [RHEL-47642] {CVE-2024-39501} - udp: do not accept non-tunnel GSO skbs landing in a tunnel (Xin Long) [RHEL-42997] {CVE-2024-35884} - filelock: Remove locks reliably when fcntl/close race is detected (Bill O'Donnell) [RHEL-50170] {CVE-2024-41012} - Input: add bounds checking to input_set_capability() (Benjamin Tissoires) [RHEL-21413] {CVE-2022-48619} - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() (CKI Backport Bot) [RHEL-48130] {CVE-2024-40959} - blk-cgroup: fix list corruption from reorder of WRITE ->lqueued (Ming Lei) [RHEL-33695] - blk-cgroup: fix list corruption from resetting io stat (Ming Lei) [RHEL-33695] - net: do not leave a dangling sk pointer, when socket creation fails (CKI Backport Bot) [RHEL-48060] {CVE-2024-40954} - perf/x86/lbr: Filter vsyscall addresses (Michael Petlan) [RHEL-28991] {CVE-2023-52476} - vmci: prevent speculation leaks by sanitizing event in event_deliver() (CKI Backport Bot) [RHEL-47678] {CVE-2024-39499} - serial: core: fix transmit-buffer reset and memleak (Steve Best) [RHEL-38731] {CVE-2021-47527} - powerpc/pseries: Whitelist dtl slub object for copying to userspace (Mamatha Inamdar) [RHEL-51236] {CVE-2024-41065} - powerpc/eeh: avoid possible crash when edev->pdev changes (Mamatha Inamdar) [RHEL-51220] {CVE-2024-41064} - x86: stop playing stack games in profile_pc() (Steve Best) [RHEL-51643] {CVE-2024-42096} - mptcp: ensure snd_una is properly initialized on connect (Florian Westphal) [RHEL-47933 RHEL-47934] {CVE-2024-40931} - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet (CKI Backport Bot) [RHEL-47492] {CVE-2024-39506} - tun: add missing verification for short frame (Patrick Talbert) [RHEL-50194] {CVE-2024-41091} - tap: add missing verification for short frame (Patrick Talbert) [RHEL-50279] {CVE-2024-41090} - usb-storage: alauda: Check whether the media is initialized (Desnes Nunes) [RHEL-43708] {CVE-2024-38619} - usb-storage: alauda: Fix uninit-value in alauda_check_media() (Desnes Nunes) [RHEL-43708] {CVE-2024-38619} - hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37723] {CVE-2021-47384} - block: fix that util can be greater than 100% (Ming Lei) [RHEL-23074] - block: support to account io_ticks precisely (Ming Lei) [RHEL-23074] - watchdog: Fix possible use-after-free by calling del_timer_sync() (Steve Best) [RHEL-38795] {CVE-2021-47321} - hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37719] {CVE-2021-47385} - mlxsw: spectrum: Protect driver from buggy firmware (CKI Backport Bot) [RHEL-42245] {CVE-2021-47560} - mlxsw: Verify the accessed index doesn't exceed the array length (CKI Backport Bot) [RHEL-42245] {CVE-2021-47560} - dm: call the resume method on internal suspend (Benjamin Marzinski) [RHEL-41835] {CVE-2024-26880} - tty: Fix out-of-bound vmalloc access in imageblit (Steve Best) [RHEL-37727] {CVE-2021-47383} - hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37715] {CVE-2021-47386} - hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs (Steve Best) [RHEL-37710] {CVE-2021-47393} - nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells (Steve Best) [RHEL-38436] {CVE-2021-47497} - driver core: auxiliary bus: Fix memory leak when driver_register() fail (Steve Best) [RHEL-37901] {CVE-2021-47287} - phylib: fix potential use-after-free (cki-backport-bot) [RHEL-43764] {CVE-2022-48754} - ptp: Fix possible memory leak in ptp_clock_register() (Hangbin Liu) [RHEL-38424] {CVE-2021-47455} - NFSv4: Fix memory leak in nfs4_set_security_label (CKI Backport Bot) [RHEL-51315] {CVE-2024-41076} - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER (CKI Backport Bot) [RHEL-51618] {CVE-2024-42090} - ftruncate: pass a signed offset (CKI Backport Bot) [RHEL-51598] {CVE-2024-42084} - af_unix: Fix garbage collector racing against connect() (Felix Maurer) [RHEL-34225] {CVE-2024-26923} - virtio-net: Add validation for used length (Laurent Vivier) [RHEL-42080] {CVE-2021-47352} - net: fix possible store tearing in neigh_periodic_work() (Antoine Tenart) [RHEL-42359] {CVE-2023-52522} - tunnels: fix out of bounds access when building IPv6 PMTU error (Antoine Tenart) [RHEL-41823] {CVE-2024-26665} - vt_ioctl: fix array_index_nospec in vt_setactivate (John W. Linville) [RHEL-49141] {CVE-2022-48804} - Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() (CKI Backport Bot) [RHEL-38302] {CVE-2023-52840} - netns: Make get_net_ns() handle zero refcount net (Antoine Tenart) [RHEL-48105] {CVE-2024-40958} - tracing: Ensure visibility when inserting an element into tracing_map (Michael Petlan) [RHEL-30457] {CVE-2024-26645} - KVM: s390: fix LPSWEY handling (CKI Backport Bot) [RHEL-50072] - firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files (CKI Backport Bot) [RHEL-51144] {CVE-2024-41056} - SUNRPC: Fix a race to wake a sync task (Benjamin Coddington) [RHEL-11843] - firmware: cs_dsp: Fix overflow checking of wmfw header (CKI Backport Bot) [RHEL-50999] {CVE-2024-41039} - firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers (CKI Backport Bot) [RHEL-50987] {CVE-2024-41038} - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (Xin Long) [RHEL-48471] {CVE-2024-40995} - net: fix out-of-bounds access in ops_init (Xin Long) [RHEL-43185] {CVE-2024-36883} - x86/mce/therm_throt: Undo thermal polling properly on CPU offline (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Do not access uninitialized therm_work (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Mark throttle_active_work() as __maybe_unused (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Mask out read-only and reserved MSR bits (Steve Best) [RHEL-45310] - x86/mce/therm_throt: Optimize notifications of thermal throttle (Steve Best) [RHEL-45310] - jiffies: add utility function to calculate delta in ms (Steve Best) [RHEL-45310] - x86/mce: Lower throttling MCE messages' priority to warning (Steve Best) [RHEL-45310] - dmaengine: idxd: Fix oops during rmmod on single-CPU platforms (Eder Zulian) [RHEL-37361] {CVE-2024-35989} - xfs: don't walk off the end of a directory data block (CKI Backport Bot) [RHEL-50879] {CVE-2024-41013} - xfs: add bounds checking to xlog_recover_process_data (CKI Backport Bot) [RHEL-50856] {CVE-2024-41014} - dm-crypt: limit the size of encryption requests (Benjamin Marzinski) [RHEL-29330] - netfilter: flowtable: remove nf_ct_l4proto_find() call (Florian Westphal) [RHEL-49589] - [rt] build kernel-rt-4.18.0-553.16.1.rt7.357.el8_10 [RHEL-44553] - x86/bhi: Fix incorrect CLEAR_BRANCH_HISTORY position in entry_INT80_compat (Waiman Long) [RHEL-50648] - [rt] build kernel-rt-4.18.0-553.15.1.rt7.356.el8_10 [RHEL-44553] - Revert "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-44613] - ionic: fix use after netif_napi_del() (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - ionic: clean interrupt before enabling queue to avoid credit race (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502} - net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change (CKI Backport Bot) [RHEL-49321] {CVE-2021-47624} - xhci: Handle TD clearing for multiple streams case (CKI Backport Bot) [RHEL-47882] {CVE-2024-40927} - net: openvswitch: Fix Use-After-Free in ovs_ct_exit (cki-backport-bot) [RHEL-36362] {CVE-2024-27395} - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979} - net: bridge: mst: fix vlan use-after-free (cki-backport-bot) [RHEL-43721] {CVE-2024-36979} - irqchip/gic-v3-its: Prevent double free on error (Charles Mirabile) [RHEL-37022] {CVE-2024-35847} - irqchip/gic-v3-its: Fix potential VPE leak on error (Charles Mirabile) [RHEL-37744] {CVE-2021-47373} - i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() (Charles Mirabile) [RHEL-34735] {CVE-2022-48632} - iommu/dma: fix zeroing of bounce buffer padding used by untrusted devices (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: remove alloc_size argument to swiotlb_tbl_map_single() (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: fix swiotlb_bounce() to do partial sync's correctly (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Reinstate page-alignment for mappings >= PAGE_SIZE (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix alignment checks when both allocation and DMA masks are present (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - swiotlb: Fix double-allocation of slots due to broken alignment handling (Eder Zulian) [RHEL-36954] {CVE-2024-35814} - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (cki-backport-bot) [RHEL-44441] {CVE-2024-31076} - [rt] build kernel-rt-4.18.0-553.14.1.rt7.355.el8_10 [RHEL-44553] - s390/qeth: Fix kernel panic after setting hsuid (Mete Durlu) [RHEL-49754] - perf/core: Protect event sibling list locking against interrupt inversion (Daniel Vacek) [RHEL-31798] - vt: fix unicode buffer corruption when deleting characters (Steve Best) [RHEL-36936] {CVE-2024-35823} - cifs: translate network errors on send to -ECONNABORTED (Paulo Alcantara) [RHEL-36754] - xfs: don't block in busy flushing when freeing extents (Brian Foster) [RHEL-7984] - xfs: allow extent free intents to be retried (Brian Foster) [RHEL-7984] - xfs: pass alloc flags through to xfs_extent_busy_flush() (Brian Foster) [RHEL-7984] - xfs: use deferred frees for btree block freeing (Brian Foster) [RHEL-7984] - xfs: fix bounds check in xfs_defer_agfl_block() (Brian Foster) [RHEL-7984] - xfs: validate block number being freed before adding to xefi (Brian Foster) [RHEL-7984] - xfs: rename xfs_bmap_add_free to xfs_free_extent_later (Brian Foster) [RHEL-7984] - usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (Desnes Nunes) [RHEL-36803] {CVE-2024-35790} - stm class: Fix a double free in stm_register_device() (Steve Best) [RHEL-44514] {CVE-2024-38627} - s390/qeth: Fix potential loss of L3-IP@ in case of network issues (Mete Durlu) [RHEL-49755] - tls: fix missing memory barrier in tls_init (cki-backport-bot) [RHEL-44471] {CVE-2024-36489} - xfs: fix log recovery buffer allocation for the legacy h_size fixup (Bill O'Donnell) [RHEL-46473] {CVE-2024-39472} - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - fs/proc: do_task_stat: use __for_each_thread() (Brian Foster) [RHEL-31562] {CVE-2024-26686} - exit: Use the correct exit_code in /proc/<pid>/stat (Brian Foster) [RHEL-31562] {CVE-2024-26686} - scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool (Ewan D. Milne) [RHEL-38283] {CVE-2023-52811} - scsi: qla2xxx: Fix double free of fcport (Ewan D. Milne) [RHEL-39549] {CVE-2024-26929} - scsi: qla2xxx: Fix double free of the ha->vp_map pointer (Ewan D. Milne) [RHEL-39549] {CVE-2024-26930} - scsi: qla2xxx: Fix command flush on cable pull (Ewan D. Milne) [RHEL-39549] {CVE-2024-26931} - [rt] build kernel-rt-4.18.0-553.13.1.rt7.354.el8_10 [RHEL-44553] - redhat: remove handling of deleted rhdocs/ directory from genspec.sh (Denys Vlasenko) - x86/bugs: Fix BHI retpoline check (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI handling of RRSBA (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr' (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix BHI documentation (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Fix return type of spectre_bhi_state() (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Make CONFIG_SPECTRE_BHI_ON the default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Mitigate KVM by default (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add BHI mitigation knob (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Enumerate Branch History Injection (BHI) bug (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Define SPEC_CTRL_BHI_DIS_S (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bhi: Add support for clearing branch history at syscall entry (Waiman Long) [RHEL-28202] {CVE-2024-2201} - x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file (Waiman Long) [RHEL-28202] - perf/x86/amd/lbr: Use freeze based on availability (Waiman Long) [RHEL-28202] - Documentation/kernel-parameters: Add spec_rstack_overflow to mitigations=off (Waiman Long) [RHEL-28202] - KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace (Waiman Long) [RHEL-28202] - x86/bugs: Reset speculation control settings on init (Waiman Long) [RHEL-28202] - KVM: x86: Update KVM-only leaf handling to allow for 100% KVM-only leafs (Waiman Long) [RHEL-28202] - KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest (Waiman Long) [RHEL-28202] - mptcp: ensure snd_nxt is properly initialized on connect (Davide Caratti) [RHEL-39865] {CVE-2024-36889} - powerpc/pseries: Enforce hcall result buffer validity and size (Mamatha Inamdar) [RHEL-48291] {CVE-2024-40974} - wifi: mac80211: fix potential key use-after-free (Jose Ignacio Tornos Martinez) [RHEL-28007] {CVE-2023-52530} - cppc_cpufreq: Fix possible null pointer dereference (Mark Langsdorf) [RHEL-44137] {CVE-2024-38573} - net/sched: act_mirred: use the backlog for mirred ingress (Davide Caratti) [RHEL-31718] {CVE-2024-26740} - vfio/pci: Lock external INTx masking ops (Alex Williamson) [RHEL-31922] {CVE-2024-26810} - net: sched: sch_multiq: fix possible OOB write in multiq_tune() (Davide Caratti) [RHEL-43464] {CVE-2024-36978} - tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized (Guillaume Nault) [RHEL-37850] {CVE-2021-47304} - pstore/ram: Fix crash when setting number of cpus to an odd number (Lenny Szubowicz) [RHEL-29471] {CVE-2023-52619} - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node (Jocelyn Falempe) [RHEL-37101] {CVE-2023-52662} - drm/vmwgfx: Fix the lifetime of the bo cursor memory (Jocelyn Falempe) [RHEL-36962] {CVE-2024-35810} - drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed (Jocelyn Falempe) [RHEL-34987] {CVE-2024-26940} - drm/vmwgfx: Unmap the surface before resetting it on a plane state (Jocelyn Falempe) [RHEL-35217] {CVE-2023-52648} - drm/vmwgfx: Fix invalid reads in fence signaled events (Jocelyn Falempe) [RHEL-40010] {CVE-2024-36960} - block: Fix wrong offset in bio_truncate() (Ming Lei) [RHEL-43782] {CVE-2022-48747} - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CKI Backport Bot) [RHEL-46913] {CVE-2024-39487} - net: fix __dst_negative_advice() race (Xin Long) [RHEL-41183] {CVE-2024-36971} - igc: avoid returning frame twice in XDP_REDIRECT (Corinna Vinschen) [RHEL-33264] {CVE-2024-26853} - mac802154: fix llsec key resources release in mac802154_llsec_key_del (Steve Best) [RHEL-34967] {CVE-2024-26961} - cpufreq: exit() callback is optional (Mark Langsdorf) [RHEL-43840] {CVE-2024-38615} - cifs: prevent infinite recursion in CIFSGetDFSRefer() (Paulo Alcantara) [RHEL-34672] - cifs: lock chan_lock outside match_session (Paulo Alcantara) [RHEL-34672] - smb3: workaround negprot bug in some Samba servers (Paulo Alcantara) [RHEL-34672] - smb3: use netname when available on secondary channels (Paulo Alcantara) [RHEL-34672] - smb3: fix empty netname context on secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: populate empty hostnames for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: always iterate smb sessions using primary channel (Paulo Alcantara) [RHEL-34672] - cifs: Fix connections leak when tlink setup failed (Paulo Alcantara) [RHEL-34672] - cifs: Fix memory leak when build ntlmssp negotiate blob failed (Paulo Alcantara) [RHEL-34672] - cifs: always initialize struct msghdr smb_msg completely (Paulo Alcantara) [RHEL-34672] - cifs: don't send down the destination address to sendmsg for a SOCK_STREAM (Paulo Alcantara) [RHEL-34672] - cifs: revalidate mapping when doing direct writes (Paulo Alcantara) [RHEL-34672] - cifs: skip extra NULL byte in filenames (Paulo Alcantara) [RHEL-34672] - cifs: list_for_each() -> list_for_each_entry() (Paulo Alcantara) [RHEL-34672] - smb2: small refactor in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - cifs: Fix crash on unload of cifs_arc4.ko (Paulo Alcantara) [RHEL-34672] - cifs: remove check of list iterator against head past the loop body (Paulo Alcantara) [RHEL-34672] - cifs: fix reconnect on smb3 mount types (Paulo Alcantara) [RHEL-34672] - cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (Paulo Alcantara) [RHEL-34672] - cifs: skip trailing separators of prefix paths (Paulo Alcantara) [RHEL-34672] - cifs: fix ntlmssp on old servers (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL ptr dereference in refresh_mounts() (Paulo Alcantara) [RHEL-34672] - cifs: do not skip link targets when an I/O fails (Paulo Alcantara) [RHEL-34672] - cifs: fix confusing unneeded warning message on smb2.1 and earlier (Paulo Alcantara) [RHEL-34672] - smb3: fix snapshot mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix workstation_name for multiuser mounts (Paulo Alcantara) [RHEL-34672] - cifs: alloc_path_with_tree_prefix: do not append sep. if the path is empty (Paulo Alcantara) [RHEL-34672] - cifs: free ntlmsspblob allocated in negotiate (Paulo Alcantara) [RHEL-34672] - cifs: avoid use of dstaddr as key for fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: add server conn_id to fscache client cookie (Paulo Alcantara) [RHEL-34672] - cifs: fix missed refcounting of ipc tcon (Paulo Alcantara) [RHEL-34672] - smb2: clarify rc initialization in smb2_reconnect (Paulo Alcantara) [RHEL-34672] - cifs: populate server_hostname for extra channels (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should be set on new server (Paulo Alcantara) [RHEL-34672] - cifs: introduce cifs_ses_mark_for_reconnect() helper (Paulo Alcantara) [RHEL-34672] - cifs: protect srv_count with cifs_tcp_ses_lock (Paulo Alcantara) [RHEL-34672] - cifs: move debug print out of spinlock (Paulo Alcantara) [RHEL-34672] - cifs: do not duplicate fscache cookie for secondary channels (Paulo Alcantara) [RHEL-34672] - cifs: connect individual channel servers to primary channel server (Paulo Alcantara) [RHEL-34672] - cifs: protect session channel fields with chan_lock (Paulo Alcantara) [RHEL-34672] - cifs: do not negotiate session if session already exists (Paulo Alcantara) [RHEL-34672] - smb3: do not setup the fscache_super_cookie until fsinfo initialized (Paulo Alcantara) [RHEL-34672] - cifs: fix potential use-after-free bugs (Paulo Alcantara) [RHEL-34672] - cifs: release lock earlier in dequeue_mid error case (Paulo Alcantara) [RHEL-34672] - smb3: remove trivial dfs compile warning (Paulo Alcantara) [RHEL-34672] - cifs: support nested dfs links over reconnect (Paulo Alcantara) [RHEL-34672] - cifs: for compound requests, use open handle if possible (Paulo Alcantara) [RHEL-34672] - cifs: split out dfs code from cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant (Paulo Alcantara) [RHEL-34672] - cifs: introduce new helper for cifs_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: fix print of hdr_flags in dfscache_proc_show() (Paulo Alcantara) [RHEL-34672] - cifs: send workstation name during ntlmssp session setup (Paulo Alcantara) [RHEL-34672] - cifs: nosharesock should not share socket with future sessions (Paulo Alcantara) [RHEL-34672] - smb3: add dynamic trace points for socket connection (Paulo Alcantara) [RHEL-34672] - cifs: Move SMB2_Create definitions to the shared area (Paulo Alcantara) [RHEL-34672] - cifs: Move more definitions into the shared area (Paulo Alcantara) [RHEL-34672] - cifs: move NEGOTIATE_PROTOCOL definitions out into the common area (Paulo Alcantara) [RHEL-34672] - cifs: Create a new shared file holding smb2 pdu definitions (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect check for null pointer in header_assemble (Paulo Alcantara) [RHEL-34672] - smb3: correct server pointer dereferencing check to be more consistent (Paulo Alcantara) [RHEL-34672] - cifs: Deal with some warnings from W=1 (Paulo Alcantara) [RHEL-34672] - cifs: fix a sign extension bug (Paulo Alcantara) [RHEL-34672] - cifs: fix incorrect kernel doc comments (Paulo Alcantara) [RHEL-34672] - cifs: remove pathname for file from SPDX header (Paulo Alcantara) [RHEL-34672] - cifs: move SMB FSCTL definitions to common code (Paulo Alcantara) [RHEL-34672] - cifs: rename cifs_common to smbfs_common (Paulo Alcantara) [RHEL-34672] - cifs: update FSCTL definitions (Paulo Alcantara) [RHEL-34672] - cifs: cifs_md4 convert to SPDX identifier (Paulo Alcantara) [RHEL-34672] - cifs: create a MD4 module and switch cifs.ko to use it (Paulo Alcantara) [RHEL-34672] - cifs: fork arc4 and create a separate module for it for cifs and other users (Paulo Alcantara) [RHEL-34672] - smb3: fix posix extensions mount option (Paulo Alcantara) [RHEL-34672] - cifs: fix wrong release in sess_alloc_buffer() failed path (Paulo Alcantara) [RHEL-34672] - CIFS: Fix a potencially linear read overflow (Paulo Alcantara) [RHEL-34672] - cifs: use the correct max-length for dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: create sd context must be a multiple of 8 (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp sessions of dfs connections (Paulo Alcantara) [RHEL-34672] - cifs: added WARN_ON for all the count decrements (Paulo Alcantara) [RHEL-34672] - cifs: fix missing null session check in mount (Paulo Alcantara) [RHEL-34672] - cifs: handle reconnect of tcon when there is no cached dfs referral (Paulo Alcantara) [RHEL-34672] - cifs: fix the out of range assignment to bit fields in parse_server_interfaces (Paulo Alcantara) [RHEL-34672] - smb3: fix typo in header file (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: Add support for negotiating signing algorithm (Paulo Alcantara) [RHEL-34672] - cifs: prevent NULL deref in cifs_compose_mount_options() (Paulo Alcantara) [RHEL-34672] - cifs: fix NULL dereference in smb2_check_message() (Paulo Alcantara) [RHEL-34672] - smbdirect: missing rc checks while waiting for rdma events (Paulo Alcantara) [RHEL-34672] - cifs: Avoid field over-reading memcpy() (Paulo Alcantara) [RHEL-34672] - smb311: remove dead code for non compounded posix query info (Paulo Alcantara) [RHEL-34672] - cifs: fix SMB1 error path in cifs_get_file_info_unix (Paulo Alcantara) [RHEL-34672] - smb3: fix uninitialized value for port in witness protocol move (Paulo Alcantara) [RHEL-34672] - cifs: fix unneeded null check (Paulo Alcantara) [RHEL-34672] - cifs: use SPDX-Licence-Identifier (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in cifs_debug.c (Paulo Alcantara) [RHEL-34672] - cifs: convert list_for_each to entry variant in smb2misc.c (Paulo Alcantara) [RHEL-34672] - cifs: missed ref-counting smb session in find (Paulo Alcantara) [RHEL-34672] - cifs: do not share tcp servers with dfs mounts (Paulo Alcantara) [RHEL-34672] - cifs: set a minimum of 2 minutes for refreshing dfs cache (Paulo Alcantara) [RHEL-34672] - cifs: Remove unused inline function is_sysvol_or_netlogon() (Paulo Alcantara) [RHEL-34672] - cifs: remove duplicated prototype (Paulo Alcantara) [RHEL-34672] - cifs: fix ipv6 formating in cifs_ses_add_channel (Paulo Alcantara) [RHEL-34672] - cifs: fix string declarations and assignments in tracepoints (Paulo Alcantara) [RHEL-34672] - cifs: fix memory leak in smb2_copychunk_range (Paulo Alcantara) [RHEL-34672] - SMB3: incorrect file id in requests compounded with open (Paulo Alcantara) [RHEL-34672] - smb3: if max_channels set to more than one channel request multichannel (Paulo Alcantara) [RHEL-34672] - smb3: do not attempt multichannel to server which does not support it (Paulo Alcantara) [RHEL-34672] - smb3: when mounting with multichannel include it in requested capabilities (Paulo Alcantara) [RHEL-34672] - cifs: simplify SWN code with dummy funcs instead of ifdefs (Paulo Alcantara) [RHEL-34672] - cifs: log mount errors using cifs_errorf() (Paulo Alcantara) [RHEL-34672] - cifs: switch build_path_from_dentry() to using dentry_path_raw() (Paulo Alcantara) [RHEL-34672] - cifs: fix out-of-bound memory access when calling smb3_notify() at mount point (Paulo Alcantara) [RHEL-34672] - cifs: allocate buffer in the caller of build_path_from_dentry() (Paulo Alcantara) [RHEL-34672] - cifs: make build_path_from_dentry() return const char * (Paulo Alcantara) [RHEL-34672] - cifs: remove old dead code (Paulo Alcantara) [RHEL-34672] - fs: cifs: Remove repeated struct declaration (Paulo Alcantara) [RHEL-34672] - cifs: have cifs_fattr_to_inode() refuse to change type on live inode (Paulo Alcantara) [RHEL-34672] - cifs: have ->mkdir() handle race with another client sanely (Paulo Alcantara) [RHEL-34672] - do_cifs_create(): don't set ->i_mode of something we had not created (Paulo Alcantara) [RHEL-34672] - cifs: Silently ignore unknown oplock break handle (Paulo Alcantara) [RHEL-34672] - cifs: change noisy error message to FYI (Paulo Alcantara) [RHEL-34672] - cifs: print MIDs in decimal notation (Paulo Alcantara) [RHEL-34672] - cifs: minor simplification to smb2_is_network_name_deleted (Paulo Alcantara) [RHEL-34672] - TCON Reconnect during STATUS_NETWORK_NAME_DELETED (Paulo Alcantara) [RHEL-34672] - cifs: clarify hostname vs ip address in /proc/fs/cifs/DebugData (Paulo Alcantara) [RHEL-34672] - cifs: change confusing field serverName (to ip_addr) (Paulo Alcantara) [RHEL-34672] - cifs: Reformat DebugData and index connections by conn_id. (Paulo Alcantara) [RHEL-34672] - cifs: Identify a connection by a conn_id. (Paulo Alcantara) [RHEL-34672] - smb3: negotiate current dialect (SMB3.1.1) when version 3 or greater requested (Paulo Alcantara) [RHEL-34672] - smb3: Fix out-of-bounds bug in SMB2_negotiate() (Paulo Alcantara) [RHEL-34672] - fs/cifs: Simplify bool comparison. (Paulo Alcantara) [RHEL-34672] - fs/cifs: Assign boolean values to a bool variable (Paulo Alcantara) [RHEL-34672] - cifs: Avoid error pointer dereference (Paulo Alcantara) [RHEL-34672] - cifs: Re-indent cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Unlock on errors in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Delete a stray unlock in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672] - cifs: Tracepoints and logs for tracing credit changes. (Paulo Alcantara) [RHEL-34672] - cifs: Fix some error pointers handling detected by static checker (Paulo Alcantara) [RHEL-34672] - smb3: remind users that witness protocol is experimental (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: do not log warning message if server doesn't populate salt (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: update comments clarifying SPNEGO info in negprot response (Paulo Alcantara) [RHEL-34672] - SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot rsp (Paulo Alcantara) [RHEL-34672] - SMB3: avoid confusing warning message on mount to Azure (Paulo Alcantara) [RHEL-34672] - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (Nigel Croxon) [RHEL-46662] {CVE-2024-39476} - net: fix information leakage in /proc/net/ptype (Hangbin Liu) [RHEL-44000] {CVE-2022-48757} - usb: typec: ucsi: Limit read size on v1.2 (Desnes Nunes) [RHEL-37286] {CVE-2024-35924} - minmax: relax check to allow comparison between unsigned arguments and signed constants (Desnes Nunes) [RHEL-37286] - minmax: allow comparisons of 'int' against 'unsigned char/short' (Desnes Nunes) [RHEL-37286] - minmax: allow min()/max()/clamp() if the arguments have the same signedness. (Desnes Nunes) [RHEL-37286] - minmax: add umin(a, b) and umax(a, b) (Desnes Nunes) [RHEL-37286] - minmax: fix header inclusions (Desnes Nunes) [RHEL-37286] - minmax: clamp more efficiently by avoiding extra comparison (Desnes Nunes) [RHEL-37286] - minmax: sanity check constant bounds when clamping (Desnes Nunes) [RHEL-37286] - tracing: Define the is_signed_type() macro once (Desnes Nunes) [RHEL-37286] - linux/bits.h: fix compilation error with GENMASK (Desnes Nunes) [RHEL-37286] - x86/apic: Mask IOAPIC entries when disabling the local APIC (Lenny Szubowicz) [RHEL-18077] - userfaultfd: fix a race between writeprotect and exit_mmap() (Rafael Aquini) [RHEL-38410] {CVE-2021-47461} - mm: khugepaged: skip huge page collapse for special files (Waiman Long) [RHEL-38446] {CVE-2021-47491} - cachefiles: fix memory leak in cachefiles_add_cache() (Andrey Albershteyn) [RHEL-33109] {CVE-2024-26840} - drm/amd/display: Implement bounds check for stream encoder creation in DCN301 (Michel Dänzer) [RHEL-31429] {CVE-2024-26660} - net/mlx5: Discard command completions in internal error (Kamal Heib) [RHEL-44231] {CVE-2024-38555} - drm: Don't unref the same fb many times by mistake due to deadlock handling (CKI Backport Bot) [RHEL-29011] {CVE-2023-52486} - md: fix resync softlockup when bitmap size is less than array size (Nigel Croxon) [RHEL-43942] {CVE-2024-38598} - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation (Davide Caratti) [RHEL-39712] {CVE-2024-36017} - netfilter: nf_tables: discard table flag update with pending basechain deletion (Phil Sutter) [RHEL-37205] {CVE-2024-35897} - netfilter: nf_tables: reject table flag and netdev basechain updates (Phil Sutter) [RHEL-37205] - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (Ewan D. Milne) [RHEL-40172] {CVE-2024-36924} - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (Ewan D. Milne) [RHEL-40172] {CVE-2024-36952} - netfilter: nf_tables: fix memleak in map from abort path (Phil Sutter) [RHEL-35052] {CVE-2024-27011} - netfilter: nf_tables: reject new basechain after table flag update (Phil Sutter) [RHEL-37193] {CVE-2024-35900} - netfilter: nf_tables: flush pending destroy work before exit_net release (Phil Sutter) [RHEL-37197] {CVE-2024-35899} - netfilter: complete validation of user input (Phil Sutter) [RHEL-37210] - netfilter: validate user input for expected length (Phil Sutter) [RHEL-37210] {CVE-2024-35896} - netfilter: tproxy: bail out if IP has been disabled on the device (Phil Sutter) [RHEL-44363] {CVE-2024-36270} - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (Phil Sutter) [RHEL-44532] {CVE-2024-36286} - netfilter: nf_tables: do not compare internal table flags on updates (Phil Sutter) [RHEL-35114] {CVE-2024-27065} - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (Phil Sutter) [RHEL-35028] {CVE-2024-27019} - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (Phil Sutter) [RHEL-35024] {CVE-2024-27020} - netfilter: nf_tables: __nft_expr_type_get() selects specific family type (Phil Sutter) [RHEL-35024] - netfilter: conntrack: serialize hash resizes and cleanups (Phil Sutter) [RHEL-37703] {CVE-2021-47408} - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (Phil Sutter) [RHEL-34217] {CVE-2024-26925} - netfilter: nf_tables: release batch on table validation from abort path (Phil Sutter) [RHEL-34217] - ipvlan: add ipvlan_route_v6_outbound() helper (Davide Caratti) [RHEL-38319] {CVE-2023-52796} - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.23.1.rt7.364.el8_10 [RHEL-59541] - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002] - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924} - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042} - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070} - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898} - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301} - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976} - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540} - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284} - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857} - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924} - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983} - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854} - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936} - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093} - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961} - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880} - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244} - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984} - [rt] build kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 [RHEL-53529] - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071} - [rt] build kernel-rt-4.18.0-553.21.1.rt7.362.el8_10 [RHEL-53529] - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874] - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558} - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441} - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904} - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322} - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246} - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008} - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228} - [rt] build kernel-rt-4.18.0-553.20.1.rt7.361.el8_10 [RHEL-53529] - KVM: arm64: Disassociate vcpus from redistributor region on teardown (Shaoqin Huang) [RHEL-48417] {CVE-2024-40989} - devres: Fix memory leakage caused by driver API devm_free_percpu() (CKI Backport Bot) [RHEL-55597] {CVE-2024-43871} - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (Izabela Bakollari) [RHEL-26680] {CVE-2024-26600} - nvmet-fc: avoid deadlock on delete association path (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - nvmet-fc: release reference on target port (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769} - ACPI: LPIT: Avoid u32 multiplication overflow (Mark Langsdorf) [RHEL-37062] {CVE-2023-52683} - sched/deadline: Fix task_struct reference leak (Phil Auld) [RHEL-50904] {CVE-2024-41023} - nfsd: fix crash on LOCKT on reexported NFSv3 (Benjamin Coddington) [RHEL-31515] - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path (CKI Backport Bot) [RHEL-26570] {CVE-2024-26595} - mlxsw: spectrum_acl_tcam: Move devlink param to TCAM code (Ivan Vecera) [RHEL-26570] {CVE-2024-26595} - ACPI: extlog: fix NULL pointer dereference check (Mark Langsdorf) [RHEL-29110] {CVE-2023-52605} - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() (Mark Langsdorf) [RHEL-33198] {CVE-2024-26894} - mm: prevent derefencing NULL ptr in pfn_section_valid() (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - mm, kmsan: fix infinite recursion due to RCU critical section (Audra Mitchell) [RHEL-51132] {CVE-2024-41055} - cipso: make cipso_v4_skbuff_delattr() fully remove the CIPSO options (Ondrej Mosnacek) [RHEL-30904] - cipso: fix total option length computation (Ondrej Mosnacek) [RHEL-30904] - ext4: do not create EA inode under buffer lock (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: check the return value of ext4_xattr_inode_dec_ref() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (Carlos Maiolino) [RHEL-48507] {CVE-2024-40998} - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972} - [rt] build kernel-rt-4.18.0-553.19.1.rt7.360.el8_10 [RHEL-53529] - drm/i915/vma: Fix UAF on destroy against retire race (Mika Penttilä) [RHEL-35222] {CVE-2024-26939} - RHEL-48620 (Kenneth Yin) [RHEL-48620] - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (CKI Backport Bot) [RHEL-42721] {CVE-2024-26855} - net: usb: asix: do not force pause frames support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix "can't send until first packet is send" issue (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix modprobe "sysfs: cannot create duplicate filename" (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: add proper error handling of usb read errors (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix wrong return value in asix_check_host_enable() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - asix: fix uninit-value in asix_mdio_read() (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: fix boolconv.cocci warnings (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: do not call phy_disconnect() for ax88178 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: move embedded PHY detection as early as possible (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: asix: fix uninit value bugs (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add missing stop (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: suspend PHY on driver probe (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: manage PHY PM from MAC (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: add error handling for asix_mdio_* functions (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: ax88772: add phylib support (Ken Cox) [RHEL-28108] {CVE-2021-47101} - net: usb: asix: refactor asix_read_phy_addr() and handle errors on return (Ken Cox) [RHEL-28108] {CVE-2021-47101} - SUNRPC: always free ctxt when freeing deferred request (Jay Shin) [RHEL-40936] - SUNRPC: double free xprt_ctxt while still in use (Jay Shin) [RHEL-40936] - SUNRPC: Remove svc_rqst::rq_xprt_hlen (Jay Shin) [RHEL-40936] - SUNRPC: Remove dead code in svc_tcp_release_rqst() (Jay Shin) [RHEL-40936] - x86/bugs: Extend VMware Retbleed workaround to Nehalem & earlier CPUs (Waiman Long) [RHEL-48646] - wifi: iwlwifi: read txq->read_ptr under lock (Jose Ignacio Tornos Martinez) [RHEL-39797] {CVE-2024-36922} - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (John Meneghini) [RHEL-39908] {CVE-2024-36919} - nbd: always initialize struct msghdr completely (Ming Lei) [RHEL-29498] {CVE-2024-26638} - block: don't call rq_qos_ops->done_bio if the bio isn't tracked (Ming Lei) [RHEL-42151] {CVE-2021-47412} - nvmet: fix a possible leak when destroy a ctrl during qp establishment (Maurizio Lombardi) [RHEL-52013] {CVE-2024-42152} - ipv6: prevent NULL dereference in ip6_output() (Sabrina Dubroca) [RHEL-39912] {CVE-2024-36901} - ppp: reject claimed-as-LCP but actually malformed packets (Guillaume Nault) [RHEL-51052] {CVE-2024-41044} - leds: trigger: Unregister sysfs attributes before calling deactivate() (CKI Backport Bot) [RHEL-54834] {CVE-2024-43830} - crypto: bcm - Fix pointer arithmetic (cki-backport-bot) [RHEL-44108] {CVE-2024-38579} - scsi: qedf: Ensure the copied buf is NUL terminated (John Meneghini) [RHEL-44195] {CVE-2024-38559} - x86/bhi: Avoid warning in #DB handler due to BHI mitigation (Waiman Long) [RHEL-53657] {CVE-2024-42240} - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (CKI Backport Bot) [RHEL-47529] {CVE-2024-40901} - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (CKI Backport Bot) [RHEL-39843] {CVE-2024-36902} - net: usb: ax88179_178a: improve link status logs (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: improve reset check (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: fix link status when link is set to down/up (Jose Ignacio Tornos Martinez) [RHEL-45167] - net: usb: ax88179_178a: avoid writing the mac address before first reading (Jose Ignacio Tornos Martinez) [RHEL-45167] - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953} - media: cec: cec-api: add locking in cec_release() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid confusing "transmit timed out" message (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: avoid recursive cec_claim_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: remove length check of Timer Status (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: count low-drive, error and arb-lost conditions (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add note about *_from_edid() function usage in drm (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_unconfigured() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: add adap_nb_transmit_canceled() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: don't set last_initiator if tx in progress (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: disable adapter in cec_devnode_unregister (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: core: not all messages were passed on when monitoring (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add support for Absolute Volume Control (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: log when claiming LA fails unexpectedly (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: drop activate_cnt, use state info instead (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: reconfigure if the PA changes during configuration (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: fix is_configuring state (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: stop trying LAs on CEC_TX_STATUS_TIMEOUT (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't unconfigure if already unconfigured (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add optional adap_configured callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: add xfer_timeout_ms field (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: use call_op and check for !unregistered (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix interrupt en/disable handling (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: drop unused 'enabled' field from struct cec_pin (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: fix off-by-one SFT check (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-pin: rename timer overrun variables (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: correctly pass on reply results (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: abort if the current transmit was canceled (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: call enable_adap on s_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: media/cec.h: document cec_adapter fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix a deadlock situation (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: safely unhook lists in cec_data (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: copy sequence field for the reply (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: fix trivial style warnings (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: add 'unregistered' checks (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec-adap.c: don't use flush_scheduled_work() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: Use fallthrough pseudo-keyword (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: remove unused waitq and phys_addrs fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: silence shift wrapping warning in __cec_s_log_addrs() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - media: cec: move the core to a separate directory (Kate Hsuan) [RHEL-22559] {CVE-2024-23848} - net/iucv: Avoid explicit cpumask var allocation on stack (CKI Backport Bot) [RHEL-51631] {CVE-2024-42094} - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (Dick Kennedy) [RHEL-40400] - KVM: selftests: Make hyperv_clock require TSC based system clocksource (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Run clocksource dependent tests with hyperv_clocksource_tsc_page too (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Use generic sys_clocksource_is_tsc() in vmx_nested_tsc_scaling_test (Vitaly Kuznetsov) [RHEL-19027] - KVM: selftests: Generalize check_clocksource() from kvm_clock_test (Vitaly Kuznetsov) [RHEL-19027] - firmware: cs_dsp: Return error if block header overflows file (CKI Backport Bot) [RHEL-53646] {CVE-2024-42238} - firmware: cs_dsp: Validate payload length before processing block (CKI Backport Bot) [RHEL-53638] {CVE-2024-42237} - mm, slub: fix potential memoryleak in kmem_cache_open() (Waiman Long) [RHEL-38404] {CVE-2021-47466} - slub: don't panic for memcg kmem cache creation failure (Waiman Long) [RHEL-38404] {CVE-2021-47466} - wifi: ath11k: fix htt pktlog locking (Jose Ignacio Tornos Martinez) [RHEL-38317] {CVE-2023-52800} - wifi: ath11k: fix dfs radar event locking (Jose Ignacio Tornos Martinez) [RHEL-38165] {CVE-2023-52798} - lib/generic-radix-tree.c: Don't overflow in peek() (Waiman Long) [RHEL-37737] {CVE-2021-47432} - include/linux/generic-radix-tree.h: replace kernel.h with the necessary inclusions (Waiman Long) [RHEL-37737] {CVE-2021-47432} - EDAC/i10nm: Skip the absent memory controllers (Aristeu Rozanski) [RHEL-43236] - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (John Meneghini) [RHEL-38197] {CVE-2023-52809} - gfs2: Fix potential glock use-after-free on unmount (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: simplify gdlm_put_lock with out_free label (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - gfs2: Remove ill-placed consistency check (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570} - nvme-fc: do not wait in vain when unloading module (Ewan D. Milne) [RHEL-33083] {CVE-2024-26846} - HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts (CKI Backport Bot) [RHEL-49698] {CVE-2022-48866} - scsi: qedf: Set qed_slowpath_params to zero before use (John Meneghini) [RHEL-9797] - scsi: qedf: Wait for stag work during unload (John Meneghini) [RHEL-9797] - scsi: qedf: Don't process stag work during unload and recovery (John Meneghini) [RHEL-9797] - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - mm: avoid overflows in dirty throttling logic (Audra Mitchell) [RHEL-51840] {CVE-2024-42131} - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (Audra Mitchell) [RHEL-42625] {CVE-2024-26720} - ACPI: fix NULL pointer dereference (Mark Langsdorf) [RHEL-37897] {CVE-2021-47289} - [rt] build kernel-rt-4.18.0-553.18.1.rt7.359.el8_10 [RHEL-53529] - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING (Ewan D. Milne) [RHEL-39805] {CVE-2024-36920} - tun: limit printing rate when illegal packet received by tun dev (Jon Maloy) [RHEL-35046] {CVE-2024-27013} - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817} - drm/amdgpu/mes: fix use-after-free issue (Michel Dänzer) [RHEL-44043] {CVE-2024-38581} - drm/amdgpu: Fix the null pointer when load rlc firmware (Michel Dänzer) [RHEL-30603] {CVE-2024-26649} - drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (Michel Dänzer) [RHEL-35160] {CVE-2024-27042} - net/sched: Fix UAF when resolving a clash (Xin Long) [RHEL-51014] {CVE-2024-41040} - tcp_metrics: validate source addr length (Guillaume Nault) [RHEL-52025] {CVE-2024-42154} - NFSv4/pnfs: Fix a use-after-free bug in open (Benjamin Coddington) [RHEL-35508] - NFSv4: Don't hold the layoutget locks across multiple RPC calls (Benjamin Coddington) [RHEL-35508] - scsi: qedf: Make qedf_execute_tmf() non-preemptible (John Meneghini) [RHEL-51799] {CVE-2024-42124} - Input: elantech - fix stack out of bound access in elantech_change_report_id() (CKI Backport Bot) [RHEL-41938] {CVE-2021-47097} - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (CKI Backport Bot) [RHEL-28982] {CVE-2023-52478} - drm/radeon: fix UBSAN warning in kv_dpm.c (CKI Backport Bot) [RHEL-48399] {CVE-2024-40988} - usb: core: Don't hold the device lock while sleeping in do_proc_control() (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - USB: core: Make do_proc_control() and do_proc_bulk() killable (Desnes Nunes) [RHEL-43646] {CVE-2021-47582} - scsi: qedi: Fix crash while reading debugfs attribute (CKI Backport Bot) [RHEL-48327] {CVE-2024-40978} - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CKI Backport Bot) [RHEL-48309] {CVE-2024-40977} - net: tcp: accept old ack during closing (Jamie Bainbridge) [RHEL-52433] - wifi: iwlwifi: mvm: don't read past the mfuart notifcation (CKI Backport Bot) [RHEL-48016] {CVE-2024-40941} - net/iucv: fix use after free in iucv_sock_close() (Mete Durlu) [RHEL-53988] - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (CKI Backport Bot) [RHEL-47908] {CVE-2024-40929} - Input: aiptek - properly check endpoint type (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - use descriptors of current altsetting (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - Input: aiptek - fix endpoint sanity check (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836} - usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB (CKI Backport Bot) [RHEL-52373] {CVE-2024-42226} - wifi: mt76: replace skb_put with skb_put_zero (CKI Backport Bot) [RHEL-52366] {CVE-2024-42225} - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (CKI Backport Bot) [RHEL-47776] {CVE-2024-40912} - wifi: cfg80211: Lock wiphy in cfg80211_get_station (CKI Backport Bot) [RHEL-47758] {CVE-2024-40911} - VMCI: Use struct_size() in kmalloc() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (Steve Best) [RHEL-37325] {CVE-2024-35944} - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() (Steve Best) [RHEL-37325] {CVE-2024-35944} - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values (Jose Ignacio Tornos Martinez) [RHEL-51761] {CVE-2024-42114} - usb: atm: cxacru: fix endpoint checking in cxacru_bind() (CKI Backport Bot) [RHEL-51442] {CVE-2024-41097} - nfs: handle error of rpc_proc_register() in init_nfs_fs() (Scott Mayhew) [RHEL-39904] {CVE-2024-36939} - drm/radeon: check bo_va->bo is non-NULL before using it (CKI Backport Bot) [RHEL-51184] {CVE-2024-41060} - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). (CKI Backport Bot) [RHEL-51027] {CVE-2024-41041} - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (CKI Backport Bot) [RHEL-50961] {CVE-2024-41035} - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). (CKI Backport Bot) [RHEL-44408] {CVE-2024-37356} - tcp: avoid too many retransmit packets (Florian Westphal) [RHEL-48627] {CVE-2024-41007} - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() (Florian Westphal) [RHEL-48627] - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Florian Westphal) [RHEL-48627] - tcp: refactor tcp_retransmit_timer() (Florian Westphal) [RHEL-48627] - tcp: exit if nothing to retransmit on RTO timeout (Florian Westphal) [RHEL-48627] - netfilter: nf_tables: Reject tables of unsupported family (Florian Westphal) [RHEL-21418] {CVE-2023-6040} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.23.1.rt7.364.el8_10 [RHEL-59541] - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002] - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924} - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042} - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070} - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898} - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301} - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976} - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540} - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284} - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857} - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924} - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983} - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854} - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936} - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093} - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961} - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880} - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244} - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984} - [rt] build kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 [RHEL-53529] - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071} - [rt] build kernel-rt-4.18.0-553.21.1.rt7.362.el8_10 [RHEL-53529] - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874] - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558} - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441} - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904} - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322} - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246} - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008} - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228} - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.23.1.rt7.364.el8_10 [RHEL-59541] - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002] - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924} - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017} - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042} - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070} - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898} - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503} - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301} - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976} - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540} - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284} - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857} - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924} - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983} - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854} - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936} - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093} - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961} - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880} - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066} - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839} - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244} - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.24.1.rt7.365.el8_10 [RHEL-59541] - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729] - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889} - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000] - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935} - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608} - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586} - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018} - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892} - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - [rt] build kernel-rt-4.18.0-553.26.1.rt7.367.el8_10 [RHEL-59541] - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062} - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037] - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156] - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757] - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757] - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757] - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757] - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757] - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757] - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757] - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757] - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757] - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757] - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757] - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757] - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757] - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492} - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939} - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075] - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397] - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251] - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251] - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251] - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251] - [rt] build kernel-rt-4.18.0-553.25.1.rt7.366.el8_10 [RHEL-59541] - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052] - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052] - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052] - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052] - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052] - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052] - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052] - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052] - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052] - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052] - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052] - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052] - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052] - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052] - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052] - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052] - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224] - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292} - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079} - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541} - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - [rt] build kernel-rt-4.18.0-553.35.1.rt7.376.el8_10 [RHEL-72569] - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480] - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480] - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396] - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - [rt] build kernel-rt-4.18.0-553.29.1.rt7.370.el8_10 [RHEL-66248] - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399} - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858} - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002] - locking/rtmutex: Prevent deadlock with `pa_lock` (Daniel Vacek) [RHEL-60475] - [rt] build kernel-rt-4.18.0-553.28.1.rt7.369.el8_10 [RHEL-59541] - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702] - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400] - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400] - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400] - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991] - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann) - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709] - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004] - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999] - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263] - [rt] build kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 [RHEL-59541] - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668} - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989} - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990} - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009} - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773} - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257] - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257] - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826} - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100] - loopback: fix lockdep splat (Xin Long) [RHEL-58100] - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100] - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - [rt] build kernel-rt-4.18.0-553.35.1.rt7.376.el8_10 [RHEL-72569] - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480] - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480] - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396] - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - [rt] build kernel-rt-4.18.0-553.32.1.rt7.373.el8_10 [RHEL-68615] - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192} - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082} - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869] - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869] - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869] - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869] - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869] - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869] - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869] - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869] - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869] - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869] - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080] - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264} - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585] - [rt] build kernel-rt-4.18.0-553.31.1.rt7.372.el8_10 [RHEL-68615] - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110} - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256} - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862] - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862] - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988] - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988] - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988] - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988] - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988] - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988] - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988] - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695} - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823] - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823] - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099} - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949} - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142} - [rt] build kernel-rt-4.18.0-553.30.1.rt7.371.el8_10 [RHEL-66248] - locking/rtmutex: Use rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Provide rt_mutex specific scheduler helpers (Daniel Vacek) [RHEL-63166] - sched: Extract __schedule_loop() (Daniel Vacek) [RHEL-63166] - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043} - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200] - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684] - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684] - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363] - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363] - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363] - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168] - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168] - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - [rt] build kernel-rt-4.18.0-553.35.1.rt7.376.el8_10 [RHEL-72569] - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480] - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480] - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396] - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396] - [rt] build kernel-rt-4.18.0-553.34.1.rt7.375.el8_10 [RHEL-71211] - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122} - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647] - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924] - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974] - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362] - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860] - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088} - [rt] build kernel-rt-4.18.0-553.33.1.rt7.374.el8_10 [RHEL-70219] - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073] - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796] - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - [rt] build kernel-rt-4.18.0-553.36.1.rt7.377.el8_10 [RHEL-73392] - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649] - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790] - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790] - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790] - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - [rt] build kernel-rt-4.18.0-553.37.1.rt7.378.el8_10 [RHEL-74366] - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275} - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275] - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275] - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275] - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - [rt] build kernel-rt-4.18.0-553.38.1.rt7.379.el8_10 [RHEL-76054] - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891] - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385] - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385] - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451] - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451] - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451] - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451] - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387] - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.39.1.rt7.380.el8_10 [RHEL-76054] - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [RHEL-73915] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - [rt] build kernel-rt-4.18.0-553.42.1.rt7.383.el8_10 [RHEL-79698] - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261] - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458] - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950] - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415] - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161] - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826] - [rt] build kernel-rt-4.18.0-553.41.1.rt7.382.el8_10 [RHEL-79698] - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886] - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599] - [rt] build kernel-rt-4.18.0-553.40.1.rt7.381.el8_10 [RHEL-76054] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104} - [rt] build kernel-rt-4.18.0-553.5.1.rt7.346.el8_10 [RHEL-34640] - tools/power/turbostat: Fix uncore frequency file string (David Arcari) [RHEL-29238] - tools/power turbostat: Expand probe_intel_uncore_frequency() (David Arcari) [RHEL-29238] - uio: Fix use-after-free in uio_open (Ricardo Robaina) [RHEL-26232] {CVE-2023-52439} - net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (Ken Cox) [RHEL-27316] {CVE-2021-47013} - keys: Fix linking a duplicate key to a keyring's assoc_array (David Howells) [RHEL-30772] - keys: Hoist locking out of __key_link_begin() (David Howells) [RHEL-30772] - keys: Break bits out of key_unlink() (David Howells) [RHEL-30772] - keys: Change keyring_serialise_link_sem to a mutex (David Howells) [RHEL-30772] - wifi: brcm80211: handle pmk_op allocation failure (Jose Ignacio Tornos Martinez) [RHEL-35150] {CVE-2024-27048} - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work (Jose Ignacio Tornos Martinez) [RHEL-35140] {CVE-2024-27052} - wifi: iwlwifi: mvm: ensure offloading TID queue exists (Jose Ignacio Tornos Martinez) [RHEL-35130] {CVE-2024-27056} - wifi: mt76: mt7921e: fix use-after-free in free_irq() (Jose Ignacio Tornos Martinez) [RHEL-34866] {CVE-2024-26892} - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete (Jose Ignacio Tornos Martinez) [RHEL-34189] {CVE-2024-26897} - wifi: iwlwifi: mvm: fix a crash when we run out of stations (Jose Ignacio Tornos Martinez) [RHEL-31547] {CVE-2024-26693} - wifi: iwlwifi: fix double-free bug (Jose Ignacio Tornos Martinez) [RHEL-31543] {CVE-2024-26694} - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (Jose Ignacio Tornos Martinez) [RHEL-29089] {CVE-2023-52594} - wifi: rt2x00: restart beacon queue when hardware reset (Jose Ignacio Tornos Martinez) [RHEL-29093] {CVE-2023-52595} - wifi: iwlwifi: fix a memory corruption (Jose Ignacio Tornos Martinez) [RHEL-28903] {CVE-2024-26610} - [rt] build kernel-rt-4.18.0-553.4.1.rt7.345.el8_10 [RHEL-34640] - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117] - net/mlx5e: Prevent deadlock while disabling aRFS (Kamal Heib) [RHEL-35041] {CVE-2024-27014} - x86/tsc: Defer marking TSC unstable to a worker (Wander Lairson Costa) [RHEL-32676] - x86/smpboot: Make TSC synchronization function call based (Wander Lairson Costa) [RHEL-32676] - net: usb: fix possible use-after-free in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - net: usb: fix memory leak in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - [rt] build kernel-rt-4.18.0-552.3.1.rt7.344.el8_10 [RHEL-34640] - netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (Phil Sutter) [RHEL-30076] {CVE-2024-26643} - netfilter: nf_tables: disallow anonymous set with timeout flag (Phil Sutter) [RHEL-30080] {CVE-2024-26642} - selftests/bpf: Fix pyperf180 compilation failure with clang18 (Artem Savkov) [RHEL-35576] - md/raid5: fix atomicity violation in raid5_cache_count (Nigel Croxon) [RHEL-27930] {CVE-2024-23307} - usb: ulpi: Fix debugfs directory leak (Desnes Nunes) [RHEL-33287] {CVE-2024-26919} - powerpc/pseries: Fix potential memleak in papr_get_attr() (Mamatha Inamdar) [RHEL-35213] {CVE-2022-48669} - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (Desnes Nunes) [RHEL-35122] {CVE-2024-27059} - NFSv4: fairly test all delegations on a SEQ4_ revocation (Benjamin Coddington) [RHEL-34912] - USB: core: Fix deadlock in usb_deauthorize_interface() (Desnes Nunes) [RHEL-35002] {CVE-2024-26934} - usb: xhci: Add error handling in xhci_map_urb_for_dma (Desnes Nunes) [RHEL-34958] {CVE-2024-26964} - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (Ewan D. Milne) [RHEL-35076] {CVE-2024-26993} - xhci: handle isoc Babble and Buffer Overrun events properly (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - xhci: process isoc TD properly when there was a transaction error mid TD. (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - USB: core: Fix deadlock in port "disable" sysfs attribute (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - USB: core: Add hub_get() and hub_put() routines (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - netfilter: ipset: Missing gc cancellations fixed (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix performance regression in swap operation (Phil Sutter) [RHEL-30521] - netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test (Phil Sutter) [RHEL-30521] - x86/apic/x2apic: Fix a NULL pointer deref when handling a dying cpu (David Arcari) [RHEL-32516] - x86/coco: Disable 32-bit emulation by default on TDX and SEV (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Make IA32_EMULATION boot time configurable (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/elf: Make loading of 32bit processes depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Rename ignore_sysret() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/cpu: Don't write CSTAR MSR on Intel CPUs (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Introduce ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - [rt] build kernel-rt-4.18.0-552.2.1.rt7.343.el8_10 [RHEL-34640] - s390/ptrace: handle setting of fpc register correctly (Tobias Huschle) [RHEL-29106] {CVE-2023-52598} - net/smc: fix illegal rmb_desc access in SMC-D connection dump (Tobias Huschle) [RHEL-27746] {CVE-2024-26615} - wifi: mac80211: fix race condition on enabling fast-xmit (Jose Ignacio Tornos Martinez) [RHEL-31664] {CVE-2024-26779} - powerpc/fadump: make is_kdump_kernel() return false when fadump is active (Mamatha Inamdar) [RHEL-24401] - vmcore: remove dependency with is_kdump_kernel() for exporting vmcore (Mamatha Inamdar) [RHEL-24401] - mtd: require write permissions for locking and badblock ioctls (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - mtd: properly check all write ioctls for permissions (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - pid: take a reference when initializing `cad_pid` (Waiman Long) [RHEL-29420] {CVE-2021-47118} - i2c: i801: Don't generate an interrupt on bus reset (Prarit Bhargava) [RHEL-30325] {CVE-2021-47153} - RDMA/srpt: Do not register event handler until srpt device is fully setup (Kamal Heib) [RHEL-33224] {CVE-2024-26872} - ceph: switch to corrected encoding of max_xattr_size in mdsmap (Xiubo Li) [RHEL-26723] - ceph: switch to use cap_delay_lock for the unlink delay list (Xiubo Li) [RHEL-32870] - ceph: pass ino# instead of old_dentry if it's disconnected (Xiubo Li) [RHEL-32870] - fat: fix uninitialized field in nostale filehandles (Andrey Albershteyn) [RHEL-33186 RHEL-35108] {CVE-2024-26973} - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (Andrey Albershteyn) [RHEL-33186] {CVE-2024-26901} - idpf: limit the support to GCP only (Michal Schmidt) [RHEL-15652] - redhat/configs: enable CONFIG_IDPF (Michal Schmidt) [RHEL-15652] - idpf: remove the use of ETHTOOL_RING_USE_TCP_DATA_SPLIT (Michal Schmidt) [RHEL-15652] - idpf: workaround for unavailable skb page recycling (Michal Schmidt) [RHEL-15652] - idpf: always allocate a full page (Michal Schmidt) [RHEL-15652] - idpf: remove page pool stats code (Michal Schmidt) [RHEL-15652] - idpf: add minimal macros for __free(kfree) to work (Michal Schmidt) [RHEL-15652] - idpf: fixup include paths for RHEL 8 (Michal Schmidt) [RHEL-15652] - idpf: fix kernel panic on unknown packet types (Michal Schmidt) [RHEL-15652] - idpf: disable local BH when scheduling napi for marker packets (Michal Schmidt) [RHEL-15652] - idpf: remove dealloc vector msg err in idpf_intr_rel (Michal Schmidt) [RHEL-15652] - idpf: fix minor controlq issues (Michal Schmidt) [RHEL-15652] - idpf: prevent deinit uninitialized virtchnl core (Michal Schmidt) [RHEL-15652] - idpf: cleanup virtchnl cruft (Michal Schmidt) [RHEL-15652] - idpf: refactor idpf_recv_mb_msg (Michal Schmidt) [RHEL-15652] - idpf: add async_handler for MAC filter messages (Michal Schmidt) [RHEL-15652] - idpf: refactor remaining virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor queue related virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor vport virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: implement virtchnl transaction manager (Michal Schmidt) [RHEL-15652] - idpf: add idpf_virtchnl.h (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler padding in virtchnl2_ptype struct (Michal Schmidt) [RHEL-15652] - idpf: distinguish vports by the dev_port attribute (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler introduced padding in virtchnl2_rss_key struct (Michal Schmidt) [RHEL-15652] - idpf: fix corrupted frames and skb leaks in singleq mode (Michal Schmidt) [RHEL-15652] - idpf: refactor some missing field get/prep conversions (Michal Schmidt) [RHEL-15652] - idpf: add get/set for Ethtool's header split ringparam (Michal Schmidt) [RHEL-15652] - idpf: fix potential use-after-free in idpf_tso() (Michal Schmidt) [RHEL-15652] - idpf: cancel mailbox work in error path (Michal Schmidt) [RHEL-15652] - idpf: set scheduling mode for completion queue (Michal Schmidt) [RHEL-15652] - idpf: add SRIOV support and other ndo_ops (Michal Schmidt) [RHEL-15652] - idpf: add ethtool callbacks (Michal Schmidt) [RHEL-15652] - idpf: add singleq start_xmit and napi poll (Michal Schmidt) [RHEL-15652] - idpf: add RX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add TX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add splitq start_xmit (Michal Schmidt) [RHEL-15652] - idpf: initialize interrupts and enable vport (Michal Schmidt) [RHEL-15652] - idpf: configure resources for RX queues (Michal Schmidt) [RHEL-15652] - idpf: configure resources for TX queues (Michal Schmidt) [RHEL-15652] - idpf: add ptypes and MAC filter support (Michal Schmidt) [RHEL-15652] - idpf: add create vport and netdev configuration (Michal Schmidt) [RHEL-15652] - idpf: add core init and interrupt request (Michal Schmidt) [RHEL-15652] - idpf: add controlq init and reset checks (Michal Schmidt) [RHEL-15652] - idpf: add module register and probe functionality (Michal Schmidt) [RHEL-15652] - virtchnl: add virtchnl version 2 ops (Michal Schmidt) [RHEL-15652] - net: netdev_queue: netdev_txq_completed_mb(): fix wake condition (Michal Schmidt) [RHEL-15652] - net: piggy back on the memory barrier in bql when waking queues (Michal Schmidt) [RHEL-15652] - net: provide macros for commonly copied lockless queue stop/wake code (Michal Schmidt) [RHEL-15652] - [rt] build kernel-rt-4.18.0-552.1.1.rt7.342.el8_10 [RHEL-34640] - build: Update RTBZ for 8.10 z-stream builds (Denys Vlasenko) - redhat: set DIST to el8_10 and ZSTREAM to yes for 8.10 (Denys Vlasenko) - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (Prarit Bhargava) [RHEL-32590] {CVE-2021-47185} - net: mana: Fix Rx DMA datasize and skb_over_panic (Cathy Avery) [RHEL-32579] - RDMA/srpt: Support specifying the srpt_service_guid parameter (Kamal Heib) [RHEL-31710] {CVE-2024-26744} - RDMA/qedr: Fix qedr_create_user_qp error flow (Kamal Heib) [RHEL-31714] {CVE-2024-26743} - hwmon: (coretemp) Fix out-of-bounds memory access (David Arcari) [RHEL-31305] {CVE-2024-26664} - RDMA/irdma: Fix KASAN issue with tasklet (Kamal Heib) [RHEL-15776] - net: bridge: use DEV_STATS_INC() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: Fix unwanted sign extension in netdev_stats_to_stats64() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: add atomic_long_t to net_device_stats fields (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net/sched: act_ct: fix skb leak and crash on ooo frags (Xin Long) [RHEL-29467] {CVE-2023-52610} - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Jose Ignacio Tornos Martinez) [RHEL-28015] {CVE-2023-52528} - RDMA/core: Fix uninit-value access in ib_get_eth_speed() (Kamal Heib) [RHEL-30130] - RDMA/core: Get IB width and speed from netdev (Kamal Heib) [RHEL-30130] - cpufreq: intel_pstate: Add Emerald Rapids support in no-HWP mode (Prarit Bhargava) [RHEL-29444] - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add (Mamatha Inamdar) [RHEL-29118] {CVE-2023-52607} - powerpc/lib: Validate size for vector operations (Mamatha Inamdar) [RHEL-29114] {CVE-2023-52606} - usb: hub: Guard against accesses to uninitialized BOS descriptors (Desnes Nunes) [RHEL-28986] {CVE-2023-52477} - media: uvcvideo: Fix OOB read (Desnes Nunes) [RHEL-27940] {CVE-2023-52565} - media: pvrusb2: fix use after free on context disconnection (Desnes Nunes) [RHEL-26498] {CVE-2023-52445} - i2c: i801: Fix block process call transactions (Prarit Bhargava) [RHEL-26478] {CVE-2024-26593} - overlay: disable EVM (Coiby Xu) [RHEL-19863] - evm: add support to disable EVM on unsupported filesystems (Coiby Xu) [RHEL-19863] - evm: don't copy up 'security.evm' xattr (Coiby Xu) [RHEL-19863] - net: ena: Remove ena_select_queue (Kamal Heib) [RHEL-14286] - media: dvbdev: Fix memory leak in dvb_media_device_free() (Prarit Bhargava) [RHEL-27254] {CVE-2020-36777} - gfs2: Fix invalid metadata access in punch_hole (Andrew Price) [RHEL-28784] - i2c: Fix a potential use after free (Prarit Bhargava) [RHEL-26849] {CVE-2019-25162} - i2c: validate user data in compat ioctl (Prarit Bhargava) [RHEL-27022] {CVE-2021-46934} - platform/x86: think-lmi: Fix reference leak (Prarit Bhargava) [RHEL-28030] {CVE-2023-52520} - vhost: use kzalloc() instead of kmalloc() followed by memset() (Jon Maloy) [RHEL-21505] {CVE-2024-0340} - RDMA/siw: Fix connection failure handling (Kamal Heib) [RHEL-28042] {CVE-2023-52513} - vt: fix memory overlapping when deleting chars in the buffer (Waiman Long) [RHEL-27778 RHEL-27779] {CVE-2022-48627} - x86/fpu: Stop relying on userspace for info to fault in xsave buffer (Steve Best) [RHEL-26669] {CVE-2024-26603} - mptcp: fix double-free on socket dismantle (Davide Caratti) [RHEL-22773] {CVE-2024-26782} - crypto: akcipher - Disable signing and decryption (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: akcipher - default implementations for request callbacks (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: testmgr - split akcipher tests by a key type (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - workqueue: Warn when a rescuer could not be created (Waiman Long) [RHEL-22136] - RDMA/cma: Avoid GID lookups on iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/cma: Deduplicate error flow in cma_validate_port() (Benjamin Coddington) [RHEL-12456] - RDMA/core: Set gid_attr.ndev for iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/siw: Fabricate a GID on tun and loopback devices (Benjamin Coddington) [RHEL-12456] - eventpoll: fix missing wakeup for ovflist in ep_poll_callback (Luis Claudio R. Goncalves) [RHEL-23022] - [rt] build kernel-rt-4.18.0-552.rt7.341.el8 [RHEL-5332] - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248] - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248] - [rt] build kernel-rt-4.18.0-551.rt7.340.el8 [RHEL-5332] - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742} - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992] - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992] - [rt] build kernel-rt-4.18.0-550.rt7.339.el8 [RHEL-5332] - mm/sparsemem: fix race in accessing memory_section->usage (Waiman Long) [RHEL-28875 RHEL-28876] {CVE-2023-52489} - mm: use __pfn_to_section() instead of open coding it (Waiman Long) [RHEL-28875] {CVE-2023-52489} - [rt] build kernel-rt-4.18.0-549.rt7.338.el8 [RHEL-5332] - dm-integrity: align the outgoing bio in integrity_recheck (Benjamin Marzinski) [RHEL-29678] - dm-integrity: fix a memory leak when rechecking the data (Benjamin Marzinski) [RHEL-29678] - RDMA/mana_ib: Add CQ interrupt support for RAW QP (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: query device capabilities (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: register RDMA device with GDMA (Maxim Levitsky) [RHEL-23934] - net: mana: add msix index sharing between EQs (Maxim Levitsky) [RHEL-23934] - net: mana: Fix spelling mistake "enforecement" -> "enforcement" (Maxim Levitsky) [RHEL-23934] - net :mana :Add remaining GDMA stats for MANA to ethtool (Maxim Levitsky) [RHEL-23934] - net: mana: Fix oversized sge0 for GSO packets (Maxim Levitsky) [RHEL-23934] - net: mana: Fix TX CQE error handling (Maxim Levitsky) [RHEL-23934] - net: mana: Add gdma stats to ethtool output for mana (Maxim Levitsky) [RHEL-23934] - net: mana: Fix MANA VF unload when hardware is unresponsive (Maxim Levitsky) [RHEL-23934] - net: mana: Configure hwc timeout from hardware (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (Maxim Levitsky) [RHEL-23934] - [rt] build kernel-rt-4.18.0-548.rt7.337.el8 [RHEL-5332] - gitlab-ci: enable arm64/s390x/ppc64le debug builds (Michael Hofmann) - arm64: Add missing bits of AmpereOne Spectre-BHB mitigation (Mark Salter) [RHEL-29005] - [rt] enable CONFIG_DRM_MGAG200_IOBURST_WORKAROUND (Jocelyn Falempe) [RHEL-13214] - drm/mgag200: Add a workaround for low-latency (Jocelyn Falempe) [RHEL-13214] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - [rt] build kernel-rt-4.18.0-553.43.1.rt7.384.el8_10 [RHEL-81037] - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999] - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999] - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894] - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971] - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229] - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229] - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229] - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807} - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756] - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - [rt] build kernel-rt-4.18.0-553.44.1.rt7.385.el8_10 [RHEL-81037] - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302} - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197} - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - [rt] build kernel-rt-4.18.0-553.45.1.rt7.386.el8_10 [RHEL-81037] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269] - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269] - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269] - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269] - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269] - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269] - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937} - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269] - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922} - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694] - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694] - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810] - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - [rt] build kernel-rt-4.18.0-553.46.1.rt7.387.el8_10 [RHEL-83409] - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934] - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934] - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934] - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832] - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785} - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - [rt] build kernel-rt-4.18.0-553.48.1.rt7.389.el8_10 [RHEL-85282] - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves) - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208] - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208] - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208] - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208] - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208] - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208] - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208] - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208] - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208] - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208] - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208] - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208] - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208] - [rt] build kernel-rt-4.18.0-553.47.1.rt7.388.el8_10 [RHEL-84273] - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136] - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156] - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - [rt] build kernel-rt-4.18.0-553.50.1.rt7.391.el8_10 [RHEL-85282] - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119] - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150} - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052] - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852] - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852] - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852] - [rt] build kernel-rt-4.18.0-553.49.1.rt7.390.el8_10 [RHEL-85282] - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244] - redhat: drop Y issues from changelog (Jan Stancek) - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673] - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673] - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673] - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673] - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673] - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499] - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - [rt] build kernel-rt-4.18.0-553.52.1.rt7.393.el8_10 [RHEL-89372] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141} - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285] - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266] - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266] - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266] - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266] - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342] - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875] - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875] - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875] - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875] - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011} - [rt] build kernel-rt-4.18.0-553.51.1.rt7.392.el8_10 [RHEL-88408] - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072] - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - [rt] build kernel-rt-4.18.0-553.54.1.rt7.395.el8_10 - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834] - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842} - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963] - [rt] build kernel-rt-4.18.0-553.53.1.rt7.394.el8_10 [RHEL-90380] - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906} - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712] - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970} - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717} - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819] - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714] - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793] - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756} - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756} - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - [rt] build kernel-rt-4.18.0-553.55.1.rt7.396.el8_10 - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-85171] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - [rt] build kernel-rt-4.18.0-553.56.1.rt7.397.el8_10 - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963] - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395} Resolves:RHEL-86963, RHEL-90261 - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - [rt] build kernel-rt-4.18.0-553.58.1.rt7.399.el8_10 - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764} - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765} - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535] - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116} - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182] - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182] - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182] - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182] - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182] - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182] - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182] - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065} - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890} - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182] - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182] - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057} - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182] - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182] - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182] - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182] - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182] - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849] - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064} - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274} - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182] - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932} - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182] - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964} - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182] - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182] - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182] - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182] - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182] - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182] - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182] - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182] - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182] - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182] - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182] - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783] - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783] - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783] - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783] - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783] - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783] - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783] - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783] - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783] - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783] - [rt] build kernel-rt-4.18.0-553.57.1.rt7.398.el8_10 - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825] - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919} - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - [rt] build kernel-rt-4.18.0-553.61.1.rt7.402.el8_10 - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409] - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738} - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150} - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004} - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991} - [rt] build kernel-rt-4.18.0-553.60.1.rt7.401.el8_10 - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037] - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037] - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192] - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846} - [rt] build kernel-rt-4.18.0-553.59.1.rt7.400.el8_10 - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291] - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291] - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291] - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132] - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111} - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136} - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709] - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932] - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - [rt] build kernel-rt-4.18.0-553.62.1.rt7.403.el8_10 - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557] - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410] - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410] - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410] - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410] - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410] - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410] - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410] - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410] - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410] - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410] - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410] - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410] - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788} - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002} - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760] - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980} - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058} - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723] - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578] - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578] - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - [rt] build kernel-rt-4.18.0-553.63.1.rt7.404.el8_10 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154} - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086} - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932} - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452] - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452] - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099] - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099] - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099] - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - [rt] build kernel-rt-4.18.0-553.64.1.rt7.405.el8_10 - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256] - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977} - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905} - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292] - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292] - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292] - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10 - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890} - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415] - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079} - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077} - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698] - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698] - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680} - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095} - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698] - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079] - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020} - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928} - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10 - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422] - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - redhat: deprecate RTBZ (Alexandra Hájková) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085} - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727} - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek) - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759} - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991] - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991] - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991] - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991] - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928] - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928] - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928] - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928] - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350} - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159} - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140] - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140] - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140] - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914} - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717] - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097} - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600] - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200} - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072] - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072] - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072] - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072] - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232] - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232] - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332} - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371] - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211} - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696} - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477} - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976] - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894] - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313] - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181] - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369] - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369] - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369] - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464} - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758] - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758] - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758] - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758] - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758] - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758] - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758] - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758] - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758] - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758] - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758] - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758] - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758] - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758] - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758] - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758] - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758] - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758] - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758] - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758] - [rt] build kernel-rt-4.18.0-553.8.1.rt7.349.el8_10 [RHEL-40882] - udf: Fix NULL pointer dereference in udf_symlink function (Pavel Reichl) [RHEL-37769] {CVE-2021-47353} - net: ti: fix UAF in tlan_remove_one (Jose Ignacio Tornos Martinez) [RHEL-38940] {CVE-2021-47310} - ARM: footbridge: fix PCI interrupt mapping (Myron Stowe) [RHEL-26971] {CVE-2021-46909} - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (Kamal Heib) [RHEL-37454] {CVE-2024-36004} - net/mlx5e: Fix mlx5e_priv_init() cleanup flow (Kamal Heib) [RHEL-37424] {CVE-2024-35959} - net/mlx5: Properly link new fs rules into the tree (Kamal Heib) [RHEL-37420] {CVE-2024-35960} - net/mlx5e: fix a potential double-free in fs_any_create_groups (Kamal Heib) [RHEL-37091] {CVE-2023-52667} - net: ena: Fix incorrect descriptor free behavior (Kamal Heib) [RHEL-37428] {CVE-2024-35958} - mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - mISDN: fix possible use-after-free in HFC_cleanup() (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356} - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - implement dh fallback for primes > 4K (Vladis Dronov) [RHEL-35106] - crypto: qat - avoid division by zero (Vladis Dronov) [RHEL-35106] - crypto: qat - resolve race condition during AER recovery (Vladis Dronov) [RHEL-35106] {CVE-2024-26974} - crypto: qat - use kcalloc_node() instead of kzalloc_node() (Vladis Dronov) [RHEL-35106] - [rt] Enable CONFIG_DRM_MGAG200_DISABLE_WRITECOMBINE (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Add an option to disable Write-Combine (Jocelyn Falempe) [RHEL-36172] - drm/mgag200: Fix caching setup for remapped video memory (Jocelyn Falempe) [RHEL-36172] - Revert "drm/mgag200: Add a workaround for low-latency" (Jocelyn Falempe) [RHEL-36172] - mptcp: fix data re-injection from stale subflow (Davide Caratti) [RHEL-33133] {CVE-2024-26826} - ipv6: sr: fix incorrect unregister order (Hangbin Liu) [RHEL-31730] - ipv6: sr: fix possible use-after-free and null-ptr-deref (Hangbin Liu) [RHEL-31730] {CVE-2024-26735} - net/bnx2x: Prevent access to a freed page in page_pool (Michal Schmidt) [RHEL-14195 RHEL-33243] {CVE-2024-26859} - bnx2x: new flag for track HW resource allocation (Michal Schmidt) [RHEL-14195 RHEL-33243] - bnx2x: fix page fault following EEH recovery (Michal Schmidt) [RHEL-14195 RHEL-33243] - x86: KVM: SVM: always update the x2avic msr interception (Maxim Levitsky) [RHEL-15495] {CVE-2023-5090} - EDAC/thunderx: Fix possible out-of-bounds string access (Aristeu Rozanski) [RHEL-26573] {CVE-2023-52464} - [rt] build kernel-rt-4.18.0-553.7.1.rt7.348.el8_10 [RHEL-34640] - net: qcom/emac: fix UAF in emac_remove (Ken Cox) [RHEL-37834] {CVE-2021-47311} - perf/core: Bail out early if the request AUX area is out of bound (Michael Petlan) [RHEL-38268] {CVE-2023-52835} - crypto: pcrypt - Fix hungtask for PADATA_RESET (Herbert Xu) [RHEL-38171] {CVE-2023-52813} - drm/amdgpu: fix use-after-free bug (Jocelyn Falempe) [RHEL-31240] {CVE-2024-26656} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash (Ivan Vecera) [RHEL-37008] {CVE-2024-35854} - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update (Ivan Vecera) [RHEL-37004] {CVE-2024-35855} - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (Ivan Vecera) [RHEL-37012] {CVE-2024-35853} - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work (Ivan Vecera) [RHEL-37016] {CVE-2024-35852} - mlxsw: spectrum_acl_tcam: Fix warning during rehash (Ivan Vecera) [RHEL-37480] {CVE-2024-36007} - can: peak_pci: peak_pci_remove(): fix UAF (Jose Ignacio Tornos Martinez) [RHEL-38419] {CVE-2021-47456} - usbnet: fix error return code in usbnet_probe() (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - usbnet: sanity check for maxpacket (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495} - net/mlx5e: fix a double-free in arfs_create_groups (Kamal Heib) [RHEL-36920] {CVE-2024-35835} - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds (Jose Ignacio Tornos Martinez) [RHEL-38220] {CVE-2023-52878} - net: cdc_eem: fix tx fixup skb leak (Jose Ignacio Tornos Martinez) [RHEL-38080] {CVE-2021-47236} - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Jose Ignacio Tornos Martinez) [RHEL-38113] {CVE-2023-52703} - usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() (Desnes Nunes) [RHEL-38248] {CVE-2023-52877} - usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (Desnes Nunes) [RHEL-38240] {CVE-2023-52781} - gro: fix ownership transfer (Xin Long) [RHEL-37226] {CVE-2024-35890} - tipc: fix kernel warning when sending SYN message (Xin Long) [RHEL-38109] {CVE-2023-52700} - erspan: make sure erspan_base_hdr is present in skb->head (Xin Long) [RHEL-37230] {CVE-2024-35888} - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() (Bryan Gurney) [RHEL-17366] - scsi: mpi3mr: Sanitise num_phys (Bryan Gurney) [RHEL-17366] - netfilter: nf_tables: use timestamp to check for set element timeout (Phil Sutter) [RHEL-38023] {CVE-2024-27397} - net/ipv6: SKB symmetric hash should incorporate transport ports (Sabrina Dubroca) [RHEL-32061] - crypto: s390/aes - Fix buffer overread in CTR mode (Herbert Xu) [RHEL-37089] {CVE-2023-52669} - net: Save and restore msg_namelen in sock_sendmsg (Jamie Bainbridge) [RHEL-35893] - net: prevent address rewrite in kernel_bind() (Jamie Bainbridge) [RHEL-35893] - net: prevent rewrite of msg_name in sock_sendmsg() (Jamie Bainbridge) [RHEL-35893] - net: replace calls to sock->ops->connect() with kernel_connect() (Jamie Bainbridge) [RHEL-35893] - net: Avoid address overwrite in kernel_connect (Jamie Bainbridge) [RHEL-35893] - wifi: iwlwifi: dbg-tlv: ensure NUL termination (Jose Ignacio Tornos Martinez) [RHEL-37026] {CVE-2024-35845} - wifi: mac80211: fix potential sta-link leak (Jose Ignacio Tornos Martinez) [RHEL-36916] {CVE-2024-35838} - wifi: nl80211: reject iftype change with mesh ID change (Jose Ignacio Tornos Martinez) [RHEL-36884] {CVE-2024-27410} - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (Jose Ignacio Tornos Martinez) [RHEL-36807] {CVE-2024-35789} - Bluetooth: Avoid potential use-after-free in hci_error_reset (David Marlin) [RHEL-31826] {CVE-2024-26801} - tls: disable async encrypt/decrypt (Sabrina Dubroca) [RHEL-26362 RHEL-26409 RHEL-26420] {CVE-2024-26585 CVE-2024-26583 CVE-2024-26584} - Squashfs: check the inode number is not the invalid value of zero (Phillip Lougher) [RHEL-35096] {CVE-2024-26982} - ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/msg.c: update and document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/sem.c: document and update memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: update/document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - ipc/mqueue.c: remove duplicated code (Rafael Aquini) [RHEL-27782] {CVE-2021-47069} - net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (Kamal Heib) [RHEL-30582] {CVE-2023-52626} - Revert "ACPI: bus: Rework system-level device notification handling" (Prarit Bhargava) [RHEL-21486] - hwrng: core - Fix page fault dead lock on mmap-ed hwrng (Prarit Bhargava) [RHEL-29485] {CVE-2023-52615} - [rt] build kernel-rt-4.18.0-553.6.1.rt7.347.el8_10 [RHEL-34640] - cxgb4: Properly lock TX queue for the selftest. (John B. Wyatt IV) [RHEL-8779] - powerpc/powernv: Add a null pointer check in opal_event_init() (Mamatha Inamdar) [RHEL-37058] {CVE-2023-52686} - crypto: rsa - add a check for allocation failure (Vladis Dronov) [RHEL-35361] - crypto: rsa - allow only odd e and restrict value in FIPS mode (Vladis Dronov) [RHEL-35361] - KEYS: use kfree_sensitive with key (Vladis Dronov) [RHEL-35361] - lib/mpi: Extend the MPI library (only mpi_*_bit() part) (Vladis Dronov) [RHEL-35361] - net: ip_tunnel: prevent perpetual headroom growth (Felix Maurer) [RHEL-31814] {CVE-2024-26804} - s390/cpum_cf: make crypto counters upward compatible across machine types (Tobias Huschle) [RHEL-36048] - RDMA/mlx5: Fix fortify source warning while accessing Eth segment (Kamal Heib) [RHEL-33162] {CVE-2024-26907} - ovl: fix leaked dentry (Miklos Szeredi) [RHEL-27306] {CVE-2021-46972} - x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - x86/mm/vsyscall: Consider vsyscall page part of user address space (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - x86/mm: Add vsyscall address helper (Rafael Aquini) [RHEL-33166] {CVE-2024-26906} - mm/swap: fix race when skipping swapcache (Rafael Aquini) [RHEL-31644] {CVE-2024-26759} - swap: fix do_swap_page() race with swapoff (Rafael Aquini) [RHEL-31644] {CVE-2024-26759} - mm/swapfile: use percpu_ref to serialize against concurrent swapoff (Rafael Aquini) [RHEL-31644] {CVE-2024-26759} - mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions() (Rafael Aquini) [RHEL-29294] {CVE-2023-52560} - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr (Jiri Benc) [RHEL-29783] - block: null_blk: Fix handling of fake timeout request (Ming Lei) [RHEL-8130] - null_blk: fix poll request timeout handling (Ming Lei) [RHEL-8130] - block: null_blk: end timed out poll request (Ming Lei) [RHEL-8130] - block: null_blk: only set set->nr_maps as 3 if active poll_queues is > 0 (Ming Lei) [RHEL-8130] - null_blk: allow zero poll queues (Ming Lei) [RHEL-8130] - null_blk: Fix handling of submit_queues and poll_queues attributes (Ming Lei) [RHEL-8130] - null_blk: poll queue support (Ming Lei) [RHEL-8130] - null_blk: fix command timeout completion handling (Ming Lei) [RHEL-8130] - platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (Prarit Bhargava) [RHEL-27790] {CVE-2021-47073} - Bluetooth: avoid memcmp() out of bounds warning (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: hci_event: Fix coding style (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: hci_event: Fix using memcmp when comparing keys (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: Reject connection with the device which has same BD_ADDR (David Marlin) [RHEL-3017] {CVE-2020-26555} - Bluetooth: hci_event: Ignore NULL link key (David Marlin) [RHEL-3017] {CVE-2020-26555} - ppp_async: limit MRU to 64K (Guillaume Nault) [RHEL-31353] {CVE-2024-26675} - powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (Mamatha Inamdar) [RHEL-37078] {CVE-2023-52675} - tcp: do not accept ACK of bytes we never sent (Xin Long) [RHEL-21952] - [rt] build kernel-rt-4.18.0-553.5.1.rt7.346.el8_10 [RHEL-34640] - tools/power/turbostat: Fix uncore frequency file string (David Arcari) [RHEL-29238] - tools/power turbostat: Expand probe_intel_uncore_frequency() (David Arcari) [RHEL-29238] - uio: Fix use-after-free in uio_open (Ricardo Robaina) [RHEL-26232] {CVE-2023-52439} - net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (Ken Cox) [RHEL-27316] {CVE-2021-47013} - keys: Fix linking a duplicate key to a keyring's assoc_array (David Howells) [RHEL-30772] - keys: Hoist locking out of __key_link_begin() (David Howells) [RHEL-30772] - keys: Break bits out of key_unlink() (David Howells) [RHEL-30772] - keys: Change keyring_serialise_link_sem to a mutex (David Howells) [RHEL-30772] - wifi: brcm80211: handle pmk_op allocation failure (Jose Ignacio Tornos Martinez) [RHEL-35150] {CVE-2024-27048} - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work (Jose Ignacio Tornos Martinez) [RHEL-35140] {CVE-2024-27052} - wifi: iwlwifi: mvm: ensure offloading TID queue exists (Jose Ignacio Tornos Martinez) [RHEL-35130] {CVE-2024-27056} - wifi: mt76: mt7921e: fix use-after-free in free_irq() (Jose Ignacio Tornos Martinez) [RHEL-34866] {CVE-2024-26892} - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete (Jose Ignacio Tornos Martinez) [RHEL-34189] {CVE-2024-26897} - wifi: iwlwifi: mvm: fix a crash when we run out of stations (Jose Ignacio Tornos Martinez) [RHEL-31547] {CVE-2024-26693} - wifi: iwlwifi: fix double-free bug (Jose Ignacio Tornos Martinez) [RHEL-31543] {CVE-2024-26694} - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (Jose Ignacio Tornos Martinez) [RHEL-29089] {CVE-2023-52594} - wifi: rt2x00: restart beacon queue when hardware reset (Jose Ignacio Tornos Martinez) [RHEL-29093] {CVE-2023-52595} - wifi: iwlwifi: fix a memory corruption (Jose Ignacio Tornos Martinez) [RHEL-28903] {CVE-2024-26610} - [rt] build kernel-rt-4.18.0-553.4.1.rt7.345.el8_10 [RHEL-34640] - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117] - net/mlx5e: Prevent deadlock while disabling aRFS (Kamal Heib) [RHEL-35041] {CVE-2024-27014} - x86/tsc: Defer marking TSC unstable to a worker (Wander Lairson Costa) [RHEL-32676] - x86/smpboot: Make TSC synchronization function call based (Wander Lairson Costa) [RHEL-32676] - net: usb: fix possible use-after-free in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - net: usb: fix memory leak in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171} - [rt] build kernel-rt-4.18.0-552.3.1.rt7.344.el8_10 [RHEL-34640] - netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (Phil Sutter) [RHEL-30076] {CVE-2024-26643} - netfilter: nf_tables: disallow anonymous set with timeout flag (Phil Sutter) [RHEL-30080] {CVE-2024-26642} - selftests/bpf: Fix pyperf180 compilation failure with clang18 (Artem Savkov) [RHEL-35576] - md/raid5: fix atomicity violation in raid5_cache_count (Nigel Croxon) [RHEL-27930] {CVE-2024-23307} - usb: ulpi: Fix debugfs directory leak (Desnes Nunes) [RHEL-33287] {CVE-2024-26919} - powerpc/pseries: Fix potential memleak in papr_get_attr() (Mamatha Inamdar) [RHEL-35213] {CVE-2022-48669} - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (Desnes Nunes) [RHEL-35122] {CVE-2024-27059} - NFSv4: fairly test all delegations on a SEQ4_ revocation (Benjamin Coddington) [RHEL-34912] - USB: core: Fix deadlock in usb_deauthorize_interface() (Desnes Nunes) [RHEL-35002] {CVE-2024-26934} - usb: xhci: Add error handling in xhci_map_urb_for_dma (Desnes Nunes) [RHEL-34958] {CVE-2024-26964} - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (Ewan D. Milne) [RHEL-35076] {CVE-2024-26993} - xhci: handle isoc Babble and Buffer Overrun events properly (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - xhci: process isoc TD properly when there was a transaction error mid TD. (Desnes Nunes) [RHEL-31297] {CVE-2024-26659} - USB: core: Fix deadlock in port "disable" sysfs attribute (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - USB: core: Add hub_get() and hub_put() routines (Desnes Nunes) [RHEL-35006] {CVE-2024-26933} - netfilter: ipset: Missing gc cancellations fixed (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix performance regression in swap operation (Phil Sutter) [RHEL-30521] - netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports (Phil Sutter) [RHEL-30521] - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test (Phil Sutter) [RHEL-30521] - x86/apic/x2apic: Fix a NULL pointer deref when handling a dying cpu (David Arcari) [RHEL-32516] - x86/coco: Disable 32-bit emulation by default on TDX and SEV (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Make IA32_EMULATION boot time configurable (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/elf: Make loading of 32bit processes depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/entry: Rename ignore_sysret() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86/cpu: Don't write CSTAR MSR on Intel CPUs (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - x86: Introduce ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744} - [rt] build kernel-rt-4.18.0-552.2.1.rt7.343.el8_10 [RHEL-34640] - s390/ptrace: handle setting of fpc register correctly (Tobias Huschle) [RHEL-29106] {CVE-2023-52598} - net/smc: fix illegal rmb_desc access in SMC-D connection dump (Tobias Huschle) [RHEL-27746] {CVE-2024-26615} - wifi: mac80211: fix race condition on enabling fast-xmit (Jose Ignacio Tornos Martinez) [RHEL-31664] {CVE-2024-26779} - powerpc/fadump: make is_kdump_kernel() return false when fadump is active (Mamatha Inamdar) [RHEL-24401] - vmcore: remove dependency with is_kdump_kernel() for exporting vmcore (Mamatha Inamdar) [RHEL-24401] - mtd: require write permissions for locking and badblock ioctls (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - mtd: properly check all write ioctls for permissions (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055} - pid: take a reference when initializing `cad_pid` (Waiman Long) [RHEL-29420] {CVE-2021-47118} - i2c: i801: Don't generate an interrupt on bus reset (Prarit Bhargava) [RHEL-30325] {CVE-2021-47153} - RDMA/srpt: Do not register event handler until srpt device is fully setup (Kamal Heib) [RHEL-33224] {CVE-2024-26872} - ceph: switch to corrected encoding of max_xattr_size in mdsmap (Xiubo Li) [RHEL-26723] - ceph: switch to use cap_delay_lock for the unlink delay list (Xiubo Li) [RHEL-32870] - ceph: pass ino# instead of old_dentry if it's disconnected (Xiubo Li) [RHEL-32870] - fat: fix uninitialized field in nostale filehandles (Andrey Albershteyn) [RHEL-33186 RHEL-35108] {CVE-2024-26973} - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (Andrey Albershteyn) [RHEL-33186] {CVE-2024-26901} - idpf: limit the support to GCP only (Michal Schmidt) [RHEL-15652] - redhat/configs: enable CONFIG_IDPF (Michal Schmidt) [RHEL-15652] - idpf: remove the use of ETHTOOL_RING_USE_TCP_DATA_SPLIT (Michal Schmidt) [RHEL-15652] - idpf: workaround for unavailable skb page recycling (Michal Schmidt) [RHEL-15652] - idpf: always allocate a full page (Michal Schmidt) [RHEL-15652] - idpf: remove page pool stats code (Michal Schmidt) [RHEL-15652] - idpf: add minimal macros for __free(kfree) to work (Michal Schmidt) [RHEL-15652] - idpf: fixup include paths for RHEL 8 (Michal Schmidt) [RHEL-15652] - idpf: fix kernel panic on unknown packet types (Michal Schmidt) [RHEL-15652] - idpf: disable local BH when scheduling napi for marker packets (Michal Schmidt) [RHEL-15652] - idpf: remove dealloc vector msg err in idpf_intr_rel (Michal Schmidt) [RHEL-15652] - idpf: fix minor controlq issues (Michal Schmidt) [RHEL-15652] - idpf: prevent deinit uninitialized virtchnl core (Michal Schmidt) [RHEL-15652] - idpf: cleanup virtchnl cruft (Michal Schmidt) [RHEL-15652] - idpf: refactor idpf_recv_mb_msg (Michal Schmidt) [RHEL-15652] - idpf: add async_handler for MAC filter messages (Michal Schmidt) [RHEL-15652] - idpf: refactor remaining virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor queue related virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: refactor vport virtchnl messages (Michal Schmidt) [RHEL-15652] - idpf: implement virtchnl transaction manager (Michal Schmidt) [RHEL-15652] - idpf: add idpf_virtchnl.h (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler padding in virtchnl2_ptype struct (Michal Schmidt) [RHEL-15652] - idpf: distinguish vports by the dev_port attribute (Michal Schmidt) [RHEL-15652] - idpf: avoid compiler introduced padding in virtchnl2_rss_key struct (Michal Schmidt) [RHEL-15652] - idpf: fix corrupted frames and skb leaks in singleq mode (Michal Schmidt) [RHEL-15652] - idpf: refactor some missing field get/prep conversions (Michal Schmidt) [RHEL-15652] - idpf: add get/set for Ethtool's header split ringparam (Michal Schmidt) [RHEL-15652] - idpf: fix potential use-after-free in idpf_tso() (Michal Schmidt) [RHEL-15652] - idpf: cancel mailbox work in error path (Michal Schmidt) [RHEL-15652] - idpf: set scheduling mode for completion queue (Michal Schmidt) [RHEL-15652] - idpf: add SRIOV support and other ndo_ops (Michal Schmidt) [RHEL-15652] - idpf: add ethtool callbacks (Michal Schmidt) [RHEL-15652] - idpf: add singleq start_xmit and napi poll (Michal Schmidt) [RHEL-15652] - idpf: add RX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add TX splitq napi poll support (Michal Schmidt) [RHEL-15652] - idpf: add splitq start_xmit (Michal Schmidt) [RHEL-15652] - idpf: initialize interrupts and enable vport (Michal Schmidt) [RHEL-15652] - idpf: configure resources for RX queues (Michal Schmidt) [RHEL-15652] - idpf: configure resources for TX queues (Michal Schmidt) [RHEL-15652] - idpf: add ptypes and MAC filter support (Michal Schmidt) [RHEL-15652] - idpf: add create vport and netdev configuration (Michal Schmidt) [RHEL-15652] - idpf: add core init and interrupt request (Michal Schmidt) [RHEL-15652] - idpf: add controlq init and reset checks (Michal Schmidt) [RHEL-15652] - idpf: add module register and probe functionality (Michal Schmidt) [RHEL-15652] - virtchnl: add virtchnl version 2 ops (Michal Schmidt) [RHEL-15652] - net: netdev_queue: netdev_txq_completed_mb(): fix wake condition (Michal Schmidt) [RHEL-15652] - net: piggy back on the memory barrier in bql when waking queues (Michal Schmidt) [RHEL-15652] - net: provide macros for commonly copied lockless queue stop/wake code (Michal Schmidt) [RHEL-15652] - [rt] build kernel-rt-4.18.0-552.1.1.rt7.342.el8_10 [RHEL-34640] - build: Update RTBZ for 8.10 z-stream builds (Denys Vlasenko) - redhat: set DIST to el8_10 and ZSTREAM to yes for 8.10 (Denys Vlasenko) - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (Prarit Bhargava) [RHEL-32590] {CVE-2021-47185} - net: mana: Fix Rx DMA datasize and skb_over_panic (Cathy Avery) [RHEL-32579] - RDMA/srpt: Support specifying the srpt_service_guid parameter (Kamal Heib) [RHEL-31710] {CVE-2024-26744} - RDMA/qedr: Fix qedr_create_user_qp error flow (Kamal Heib) [RHEL-31714] {CVE-2024-26743} - hwmon: (coretemp) Fix out-of-bounds memory access (David Arcari) [RHEL-31305] {CVE-2024-26664} - RDMA/irdma: Fix KASAN issue with tasklet (Kamal Heib) [RHEL-15776] - net: bridge: use DEV_STATS_INC() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: Fix unwanted sign extension in netdev_stats_to_stats64() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net: add atomic_long_t to net_device_stats fields (Ivan Vecera) [RHEL-27989] {CVE-2023-52578} - net/sched: act_ct: fix skb leak and crash on ooo frags (Xin Long) [RHEL-29467] {CVE-2023-52610} - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Jose Ignacio Tornos Martinez) [RHEL-28015] {CVE-2023-52528} - RDMA/core: Fix uninit-value access in ib_get_eth_speed() (Kamal Heib) [RHEL-30130] - RDMA/core: Get IB width and speed from netdev (Kamal Heib) [RHEL-30130] - cpufreq: intel_pstate: Add Emerald Rapids support in no-HWP mode (Prarit Bhargava) [RHEL-29444] - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add (Mamatha Inamdar) [RHEL-29118] {CVE-2023-52607} - powerpc/lib: Validate size for vector operations (Mamatha Inamdar) [RHEL-29114] {CVE-2023-52606} - usb: hub: Guard against accesses to uninitialized BOS descriptors (Desnes Nunes) [RHEL-28986] {CVE-2023-52477} - media: uvcvideo: Fix OOB read (Desnes Nunes) [RHEL-27940] {CVE-2023-52565} - media: pvrusb2: fix use after free on context disconnection (Desnes Nunes) [RHEL-26498] {CVE-2023-52445} - i2c: i801: Fix block process call transactions (Prarit Bhargava) [RHEL-26478] {CVE-2024-26593} - overlay: disable EVM (Coiby Xu) [RHEL-19863] - evm: add support to disable EVM on unsupported filesystems (Coiby Xu) [RHEL-19863] - evm: don't copy up 'security.evm' xattr (Coiby Xu) [RHEL-19863] - net: ena: Remove ena_select_queue (Kamal Heib) [RHEL-14286] - media: dvbdev: Fix memory leak in dvb_media_device_free() (Prarit Bhargava) [RHEL-27254] {CVE-2020-36777} - gfs2: Fix invalid metadata access in punch_hole (Andrew Price) [RHEL-28784] - i2c: Fix a potential use after free (Prarit Bhargava) [RHEL-26849] {CVE-2019-25162} - i2c: validate user data in compat ioctl (Prarit Bhargava) [RHEL-27022] {CVE-2021-46934} - platform/x86: think-lmi: Fix reference leak (Prarit Bhargava) [RHEL-28030] {CVE-2023-52520} - vhost: use kzalloc() instead of kmalloc() followed by memset() (Jon Maloy) [RHEL-21505] {CVE-2024-0340} - RDMA/siw: Fix connection failure handling (Kamal Heib) [RHEL-28042] {CVE-2023-52513} - vt: fix memory overlapping when deleting chars in the buffer (Waiman Long) [RHEL-27778 RHEL-27779] {CVE-2022-48627} - x86/fpu: Stop relying on userspace for info to fault in xsave buffer (Steve Best) [RHEL-26669] {CVE-2024-26603} - mptcp: fix double-free on socket dismantle (Davide Caratti) [RHEL-22773] {CVE-2024-26782} - crypto: akcipher - Disable signing and decryption (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: akcipher - default implementations for request callbacks (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - crypto: testmgr - split akcipher tests by a key type (Herbert Xu) [RHEL-17114] {CVE-2023-6240} - workqueue: Warn when a rescuer could not be created (Waiman Long) [RHEL-22136] - RDMA/cma: Avoid GID lookups on iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/cma: Deduplicate error flow in cma_validate_port() (Benjamin Coddington) [RHEL-12456] - RDMA/core: Set gid_attr.ndev for iWARP devices (Benjamin Coddington) [RHEL-12456] - RDMA/siw: Fabricate a GID on tun and loopback devices (Benjamin Coddington) [RHEL-12456] - eventpoll: fix missing wakeup for ovflist in ep_poll_callback (Luis Claudio R. Goncalves) [RHEL-23022] - [rt] build kernel-rt-4.18.0-552.rt7.341.el8 [RHEL-5332] - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248] - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248] - [rt] build kernel-rt-4.18.0-551.rt7.340.el8 [RHEL-5332] - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742} - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992] - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360] - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360] - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234] - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985} - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812] - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453] - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107} - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798} - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350} - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932} - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392} - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449} - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713] - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160] - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655] - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655] - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125} - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556} - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498} - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498} - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193] - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797} - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609] - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087} - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228} - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302] - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825} - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237] - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724} - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513} - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921] - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921] - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921] - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921] - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921] - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386} - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817} - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841} - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920] - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297} - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111] - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909] - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909] - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909] - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909] - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909] - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909] - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909] - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909] - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909] - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909] - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909] - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909] - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909] - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909] - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909] - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909] - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909] - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909] - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909] - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909] - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909] - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909] - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909] - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909] - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909] - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909] - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909] - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909] - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909] - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909] - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909] - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909] - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909] - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909] - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909] - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909] - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909] - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909] - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909] - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909] - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909] - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909] - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909] - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909] - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909] - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909] - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909] - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909] - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909] - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909] - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909] - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909] - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909] - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909] - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909] - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909] - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909] - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909] - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909] - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909] - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909] - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909] - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909] - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909] - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909] - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909] - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909] - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909] - mm: add find_lock_head (Rafael Aquini) [RHEL-104909] - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909] - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909] - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909] - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909] - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909] - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909] - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909] - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909] - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909] - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909] - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909] - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909] - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909] - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909] - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909] - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909] - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849} - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032] - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816] - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816] - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816] - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751} - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729} - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681] - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774] - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660] - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660] - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199] - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539} - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825} - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237] - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724} - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513} - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921] - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921] - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921] - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921] - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921] - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775] - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718} - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005] - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367} - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285] - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300} - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300} - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781] - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781] - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781] - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781] - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781] - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757] - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215] - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215] - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215] - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611] - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178} - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431] - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546] - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546] - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546] - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999} - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244} - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546] - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725} - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179} - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870} - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546] - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546] - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546] - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546] - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546] - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546] - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546] - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546] - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546] - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546] - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752} - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546] - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546] - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546] - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546] - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546] - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546] - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546] - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546] - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546] - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546] - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546] - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546] - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546] - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546] - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546] - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546] - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546] - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546] - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546] - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546] - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546] - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546] - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546] - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546] - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546] - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546] - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546] - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546] - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546] - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546] - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546] - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546] - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546] - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938} - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546] - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546] - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546] - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546] - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546] - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546] - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546] - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546] - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546] - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546] - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546] - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546] - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546] - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546] - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546] - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546] - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546] - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546] - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546] - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546] - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546] - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546] - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546] - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546] - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546] - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546] - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546] - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546] - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546] - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546] - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546] - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546] - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546] - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546] - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546] - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546] - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546] - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546] - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546] - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546] - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546] - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546] - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546] - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546] - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546] - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546] - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546] - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546] - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546] - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546] - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546] - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546] - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546] - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546] - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546] - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546] - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515] - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515] - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461] - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461] - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461] - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461] - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461] - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461] - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391] - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391] - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391] - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864} - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745] - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745] - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745] - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745] - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745] - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745] - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257} - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285} - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993} - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396] - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396] - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396] - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396] - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355] - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355] - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355] - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355] - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355] - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355] - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240} - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek) - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963] - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171] - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171] - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226] - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226] - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744] - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744] - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744] - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744] - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew) [RHEL-129945] - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774] - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660] - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660] - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199] - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539} - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825} - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237] - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724} - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513} - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921] - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921] - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921] - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921] - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921] - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921] - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799] - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968} - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969} - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970} - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971} - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799] - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799] - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972} - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799] - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122] - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697} - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková) - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301} - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933} - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051} - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449] - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096} - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285} - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993} - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396] - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396] - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396] - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396] - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355] - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355] - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355] - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355] - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355] - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355] - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240} - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek) - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963] - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171] - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171] - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226] - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226] - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744] - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744] - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744] - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744] - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew) [RHEL-129945] - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774] - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401} - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660] - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660] - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199] - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539} - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664] - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129107] {CVE-2025-40154} - Bluetooth: hci_event: call disconnect callback before deleting conn (CKI Backport Bot) [RHEL-137039] {CVE-2023-53673} - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CKI Backport Bot) [RHEL-134423] {CVE-2025-40277} - xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 (John J Coleman) [RHEL-111354] - xen: Fix x86 sched_clock() interface for xen (John J Coleman) [RHEL-111354] - x86/xen/time: Output xen sched_clock time from 0 (John J Coleman) [RHEL-111354] - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Olga Kornievskaia) [RHEL-132819] - vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139273] {CVE-2025-40248} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ignore ndlp rport mismatch in dev_loss_tmo callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Modify handling of ADISC based on ndlp state and RPI registration (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Delete NLP_TARGET_REMOVE flag due to obsolete usage (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo callback (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Check devloss callbk done flag for potential stale NDLP ptrs (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kref imbalance on fabric ndlps from dev_loss_tmo handler (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Update PRLO handling in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Add condition to delete ndlp object after sending BLS_RJT to an ABTS (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove NLP_RCV_PLOGI early return during RSCN processing for ndlps (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Allow lpfc_plogi_confirm_nport() logic to execute for Fabric nodes (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix list_entry null check warning in lpfc_cmpl_els_plogi() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix possible file string name overflow when updating firmware (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Validate ELS LS_ACC completion payload (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Remove extra ndlp kref decrement in FLOGI cmpl for loop topology (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Revise NPIV ELS unsol rcv cmpl logic to drop ndlp based on nlp_state (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix double free in lpfc_cmpl_els_logo_acc() caused by lpfc_nlp_not_used() (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Move scsi_host_template outside dynamically allocated/freed phba (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fill in missing ndlp kref puts in error paths (Ewan D. Milne) [RHEL-32324] - scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login (Ewan D. Milne) [RHEL-32324] - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301} - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933} - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051} - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449] - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096} - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285} - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993} - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396] - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396] - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396] - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396] - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355] - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355] - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355] - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355] - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355] - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355] - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355] - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240} - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek) - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963] - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171] - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171] - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226] - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226] - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744] - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744] - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744] - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744] - NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew) [RHEL-129945] - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117] - [rt] build kernel-rt-4.18.0-552.rt7.341.el8 [RHEL-5332] - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248] - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248] - [rt] build kernel-rt-4.18.0-551.rt7.340.el8 [RHEL-5332] - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742} - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992] - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992] - [rt] build kernel-rt-4.18.0-550.rt7.339.el8 [RHEL-5332] - mm/sparsemem: fix race in accessing memory_section->usage (Waiman Long) [RHEL-28875 RHEL-28876] {CVE-2023-52489} - mm: use __pfn_to_section() instead of open coding it (Waiman Long) [RHEL-28875] {CVE-2023-52489} - [rt] build kernel-rt-4.18.0-549.rt7.338.el8 [RHEL-5332] - dm-integrity: align the outgoing bio in integrity_recheck (Benjamin Marzinski) [RHEL-29678] - dm-integrity: fix a memory leak when rechecking the data (Benjamin Marzinski) [RHEL-29678] - RDMA/mana_ib: Add CQ interrupt support for RAW QP (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: query device capabilities (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: register RDMA device with GDMA (Maxim Levitsky) [RHEL-23934] - net: mana: add msix index sharing between EQs (Maxim Levitsky) [RHEL-23934] - net: mana: Fix spelling mistake "enforecement" -> "enforcement" (Maxim Levitsky) [RHEL-23934] - net :mana :Add remaining GDMA stats for MANA to ethtool (Maxim Levitsky) [RHEL-23934] - net: mana: Fix oversized sge0 for GSO packets (Maxim Levitsky) [RHEL-23934] - net: mana: Fix TX CQE error handling (Maxim Levitsky) [RHEL-23934] - net: mana: Add gdma stats to ethtool output for mana (Maxim Levitsky) [RHEL-23934] - net: mana: Fix MANA VF unload when hardware is unresponsive (Maxim Levitsky) [RHEL-23934] - net: mana: Configure hwc timeout from hardware (Maxim Levitsky) [RHEL-23934] - RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (Maxim Levitsky) [RHEL-23934] - [rt] build kernel-rt-4.18.0-548.rt7.337.el8 [RHEL-5332] - gitlab-ci: enable arm64/s390x/ppc64le debug builds (Michael Hofmann) - arm64: Add missing bits of AmpereOne Spectre-BHB mitigation (Mark Salter) [RHEL-29005] - [rt] enable CONFIG_DRM_MGAG200_IOBURST_WORKAROUND (Jocelyn Falempe) [RHEL-13214] - drm/mgag200: Add a workaround for low-latency (Jocelyn Falempe) [RHEL-13214] - [rt] build kernel-rt-4.18.0-547.rt7.336.el8 [RHEL-5332] - x86/efistub: Avoid placing the kernel below LOAD_PHYSICAL_ADDR (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Give up if memory attribute protocol returns an error (Lenny Szubowicz) [RHEL-2505] - x86/boot: Increase section and file alignment to 4k/512 (Lenny Szubowicz) [RHEL-2505] - x86/boot: Split off PE/COFF .data section (Lenny Szubowicz) [RHEL-2505] - x86/boot: Drop PE/COFF .reloc section (Lenny Szubowicz) [RHEL-2505] - x86/boot: Construct PE/COFF .text section from assembler (Lenny Szubowicz) [RHEL-2505] - x86/boot: Derive file size from _edata symbol (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed: Remove, discard, or assert for unwanted sections (Lenny Szubowicz) [RHEL-2505] - x86/boot: Check that there are no run-time relocations (Lenny Szubowicz) [RHEL-2505] - x86/boot: Discard .discard.unreachable for arch/x86/boot/compressed/vmlinux (Lenny Szubowicz) [RHEL-2505] - x86/boot: Define setup size in linker script (Lenny Szubowicz) [RHEL-2505] - x86/boot: Set EFI handover offset directly in header asm (Lenny Szubowicz) [RHEL-2505] - x86/boot: Drop references to startup_64 (Lenny Szubowicz) [RHEL-2505] - x86/boot: Drop redundant code setting the root device (Lenny Szubowicz) [RHEL-2505] - x86/build: Declutter the build output (Lenny Szubowicz) [RHEL-2505] - x86/boot: Omit compression buffer from PE/COFF image memory footprint (Lenny Szubowicz) [RHEL-2505] - x86/boot: Mark global variables as static (Lenny Szubowicz) [RHEL-2505] - efi/x86: Remove extra headroom for setup block (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove the 'bugger off' message (Lenny Szubowicz) [RHEL-2505] - x86/efi: Drop alignment flags from PE section headers (Lenny Szubowicz) [RHEL-2505] - efi: Put Linux specific magic number in the DOS header (Lenny Szubowicz) [RHEL-2505] - efi/x86: Fix the missing KASLR_FLAG bit in boot_params->hdr.loadflags (Lenny Szubowicz) [RHEL-2505] - efi/x86: Avoid physical KASLR on older Dell systems (Lenny Szubowicz) [RHEL-2505] - x86/boot: efistub: Assign global boot_params variable (Lenny Szubowicz) [RHEL-2505] - x86/boot: Rename conflicting 'boot_params' pointer to 'boot_params_ptr' (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Avoid legacy decompressor when doing EFI boot (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Perform SNP feature test while running in the firmware (Lenny Szubowicz) [RHEL-2505] - x86/sev: Do not try to parse for the CC blob on non-AMD hardware (Lenny Szubowicz) [RHEL-2505] - efi/libstub: Add limit argument to efi_random_alloc() (Lenny Szubowicz) [RHEL-2505] - arm64: efi: Limit allocations to 48-bit addressable physical region (Lenny Szubowicz) [RHEL-2505] - efi: libstub: use EFI_LOADER_CODE region when moving the kernel in memory (Lenny Szubowicz) [RHEL-2505] - arm64: efi: kaslr: Fix occasional random alloc (and boot) failure (Lenny Szubowicz) [RHEL-2505] - efi/libstub/random: Increase random alloc granularity (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Factor out kernel decompression and relocation (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Move global symbol references to C code (Lenny Szubowicz) [RHEL-2505] - decompress: Use 8 byte alignment (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Prefer EFI memory attributes protocol over DXE services (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Perform 4/5 level paging switch from the stub (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Merge trampoline cleanup with switching code (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Pass pgtable address to trampoline directly (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Only call the trampoline when changing paging levels (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Call trampoline directly from C code (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Avoid the need for a stack in the 32-bit trampoline (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Use standard calling convention for trampoline (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Call trampoline as a normal function (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Remove .bss/.pgtable from bzImage (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove run-time relocations from .head.text code (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Assign paging related global variables earlier (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Store boot_params pointer in callee save register (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Clear BSS in EFI handover protocol entrypoint (Lenny Szubowicz) [RHEL-2505] - x86/head_64: Store boot_params pointer in callee save register (Lenny Szubowicz) [RHEL-2505] - x86/decompressor: Don't rely on upper 32 bits of GPRs being preserved (Lenny Szubowicz) [RHEL-2505] - x86/head/64: Switch to KERNEL_CS as soon as new GDT is installed (Lenny Szubowicz) [RHEL-2505] - efi/libstub: Add memory attribute protocol definitions (Lenny Szubowicz) [RHEL-2505] - efi/x86: libstub: remove unused variable (Lenny Szubowicz) [RHEL-2505] - x86/boot: Robustify calling startup_{32,64}() from the decompressor code (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Simplify and clean up handover entry code (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Branch straight to kernel entry point from C code (Lenny Szubowicz) [RHEL-2505] - efi/x86: Avoid using code32_start (Lenny Szubowicz) [RHEL-2505] - efi/libstub/x86: Use Exit() boot service to exit the stub on errors (Lenny Szubowicz) [RHEL-2505] - efi: x86: Wipe setup_data on pure EFI boot (Lenny Szubowicz) [RHEL-2505] - efi: x86: Fix config name for setting the NX-compatibility flag in the PE header (Lenny Szubowicz) [RHEL-2505] - efi: x86: Set the NX-compatibility flag in the PE header (Lenny Szubowicz) [RHEL-2505] - efi/x86: Add kernel preferred address to PE header (Lenny Szubowicz) [RHEL-2505] - efi/x86: Use symbolic constants in PE header instead of bare numbers (Lenny Szubowicz) [RHEL-2505] - efi/x86: Drop redundant .bss section (Lenny Szubowicz) [RHEL-2505] - efi/x86: add headroom to decompressor BSS to account for setup block (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove run-time relocations from head_{32,64}.S (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed: Fix debug_puthex() parameter type (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Use 32-bit (zero-extended) MOV for z_output_len (Lenny Szubowicz) [RHEL-2505] - x86/boot: Use unsigned comparison for addresses (Lenny Szubowicz) [RHEL-2505] - x86/boot: Micro-optimize GDT loading instructions (Lenny Szubowicz) [RHEL-2505] - x86/boot: GDT limit value should be size - 1 (Lenny Szubowicz) [RHEL-2505] - efi/x86: Remove GDT setup from efi_main (Lenny Szubowicz) [RHEL-2505] - x86/boot: Clear direction and interrupt flags in startup_64 (Lenny Szubowicz) [RHEL-2505] - efi/x86: Don't depend on firmware GDT layout (Lenny Szubowicz) [RHEL-2505] - x86/boot: Remove KEEP_SEGMENTS support (Lenny Szubowicz) [RHEL-2505] - x86/boot: Handle malformed SRAT tables during early ACPI parsing (Lenny Szubowicz) [RHEL-2505] - efi/libstub/x86: Use mandatory 16-byte stack alignment in mixed mode (Lenny Szubowicz) [RHEL-2505] - efi/libstub/x86: Avoid globals to store context during mixed mode calls (Lenny Szubowicz) [RHEL-2505] - x86/efistub: Disable paging at mixed mode entry (Lenny Szubowicz) [RHEL-2505] - x86: efi/random: Invoke EFI_RNG_PROTOCOL to seed the UEFI RNG table (Lenny Szubowicz) [RHEL-2505] - x86/asm: Make some functions local (Lenny Szubowicz) [RHEL-2505] - x86/boot: Annotate data appropriately (Lenny Szubowicz) [RHEL-2505] - x86/boot: Annotate local functions (Lenny Szubowicz) [RHEL-2505] - x86/asm: Make more symbols local (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Fix missing initialization in find_trampoline_placement() (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Fix boot on machines with broken E820 table (Lenny Szubowicz) [RHEL-2505] - x86, boot: Remove multiple copy of static function sanitize_boot_params() (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Remove unused variable (Lenny Szubowicz) [RHEL-2505] - x86/boot/compressed/64: Explain paging_prepare()'s return value (Lenny Szubowicz) [RHEL-2505] - x86/boot: Save several bytes in decompressor (Lenny Szubowicz) [RHEL-2505] - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (Audra Mitchell) [RHEL-20614] {CVE-2024-0841} - net/gve: update check for little-endianness in gve kconfig (Joshua Washington) [RHEL-29030] - [rt] build kernel-rt-4.18.0-546.rt7.335.el8 [RHEL-5332] - sched/membarrier: reduce the ability to hammer on sys_membarrier (Wander Lairson Costa) [RHEL-23430] {CVE-2024-26602} - NFS: Set the stable writes flag when initialising the super block (Benjamin Coddington) [RHEL-25266] - smb: client: fix OOB in receive_encrypted_standard() (Scott Mayhew) [RHEL-21685] {CVE-2024-0565} - scsi: core: Move scsi_host_busy() out of host lock if it is for per-command (Ming Lei) [RHEL-23942] - scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler (Ming Lei) [RHEL-23942] - gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump (Andrew Price) [RHEL-26501] {CVE-2023-52448} - smb: client: fix parsing of SMB3.1.1 POSIX create context (Paulo Alcantara) [RHEL-26241] {CVE-2023-52434} - smb: client: fix potential OOBs in smb2_parse_contexts() (Paulo Alcantara) [RHEL-26241] {CVE-2023-52434} - smb3: Replace smb2pdu 1-element arrays with flex-arrays (Jay Shin) [RHEL-22143] - cifs: Replace remaining 1-element arrays (Jay Shin) [RHEL-22143] - cifs: Convert struct fealist away from 1-element array (Jay Shin) [RHEL-22143] - cifs: remove unneeded 2bytes of padding from smb2 tree connect (Jay Shin) [RHEL-22143] - cifs: Replace zero-length arrays with flexible-array members (Jay Shin) [RHEL-22143] - cifs: Replace a couple of one-element arrays with flexible-array members (Jay Shin) [RHEL-22143] - cifs: fix FILE_BOTH_DIRECTORY_INFO definition (Jay Shin) [RHEL-22143] - nfsd: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - nfs: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - lockd: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - cifs: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - ceph: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441] - filelock: add a new locks_inode_context accessor function (Jeffrey Layton) [RHEL-27441] - dm-integrity, dm-verity: reduce stack usage for recheck (Benjamin Marzinski) [RHEL-27849] - dm-crypt: recheck the integrity tag after a failure (Benjamin Marzinski) [RHEL-27849] - dm-crypt: don't modify the data when using authenticated encryption (Benjamin Marzinski) [RHEL-27849] - dm-verity: recheck the hash after a failure (Benjamin Marzinski) [RHEL-27849] - dm-integrity: recheck the integrity tag after a failure (Benjamin Marzinski) [RHEL-27849] - [rt] build kernel-rt-4.18.0-545.rt7.334.el8 [RHEL-5332] - tracing/timerlat: Move hrtimer_init to timerlat_fd open() (John Kacur) [RHEL-26667] - tracing/perf: Fix double put of trace event when init fails (Michael Petlan) [RHEL-19537] - ipvlan: Add handling of NETDEV_UP events (Hangbin Liu) [RHEL-19098] - ceph: add ceph_cap_unlink_work to fire check_caps() immediately (Xiubo Li) [RHEL-21760] - ceph: always queue a writeback when revoking the Fb caps (Xiubo Li) [RHEL-21760] - ceph: always check dir caps asynchronously (Xiubo Li) [RHEL-21760] - nfs: fix redundant readdir request after get eof (Benjamin Coddington) [RHEL-7780] - NFSv4.1: fixup use EXCHGID4_FLAG_USE_PNFS_DS for DS server (Scott Mayhew) [RHEL-7994] - NFSv4.1: fix pnfs MDS=DS session trunking (Scott Mayhew) [RHEL-7994] - NFSv4.1: fix zero value filehandle in post open getattr (Scott Mayhew) [RHEL-7994] - NFSv4.1: use EXCHGID4_FLAG_USE_PNFS_DS for DS server (Scott Mayhew) [RHEL-7994] - x86/boot: Ignore NMIs during very early boot (Valentin Schneider) [RHEL-22749] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Build with fix for rt-setup post script Resolves: rhbz#2168478 - Remove '-s' argument to install to prevent stripping of rt-entsk Resolves: rhbz#2068537 - Rebuild for rhel-8.6, no functional change Resolves: rhbz#2042221 - added gating.yaml to turn on OSCI gating Resolves: rhbz#1682427 - build for RHEL 8.1.0 - added OSCI gating test framework Resolves: rhbz#1682427 - rebuild to see if build-id continues to appear in the rpm - fix annocheck static source analysis errors Resolves: rhbz#1619407 - fix some coverity complaints about shell scripts Resolves: rhbz#1619407 - strip rt-entsk executable on installation Resolves: rhbz#1619407 - check for open failure to make coverity happy Resolves: rhbz#1619407 - Added patchset for relative cpuset functionality from upstream Resolves: RHEL-21926 - Add an rpminspect file to pass gating which is failing due to python egg-info directory permissions Resolves: RHEL-16401 - Remove upstream spec files Resolves: RHEL-9189 - Rebase to upstream rteval-3.7 - Revert the change to use a newer default kernel Resolves: RHEL-8967 - Added patch set that enables rteval to do load calculations and reporting correctly on systems with isolated CPUs jiraProject== RHEL-8680 - Added patches to use argparse instead of deprecated optparse jiraProject == RHEL-9029 - Added patches to use f-strings where possible, no functional change jiraProject == RHEL-797 - Add tests/tests.yml and tests/scripts/run_tests.sh for gating Resolves: rhbz#2213609 jiraProject == RHELPLAN-159326 - Added code to check if the /proc/net/if_net6 file exists. Resolves: rhbz#2210106 jiraProject == RHELPLAN-158239 - Add check to catch python-dmidecode if it fails Resolves: rhbz#2168373 jiraProject == RHELPLAN-148048 - Upgrade run_tests.sh with the new kernel version Resolves: rhbz#2093059 - Upgrade the kernel to linux-5.18.1.tar.xz Resolves: rhbz#2093059 - Fix the gating test to match the kernel version delivered by rteval-loads Resolves: rhbz#2042213 - Update to kernel Resolves: rhbz#2017513 - Remove stress-ng from rteval-loads Resolves:rhbz#2007027 - Rebuild rteval-build with a fixed binutils in brew - Bump the release number of stress-ng as well Resolves: rhbz#1954451 - Update stress-ng to 0.12.06 upstream Resolves: rhbz#1947648 - Update the URL source to the correct current location. Resolves: rhbz#1914420 - Rebuild bumping up both packages release number to avoid - brew clashes Resolves: rhbz#1859763 - Rebuild excluding aarch64 since stress-ng already exists there Resolves: rhbz#1859763 - sap-netweaver: increase vm.max_map_count resolves: RHEL-32124 - release bump due to broken c8s related: RHEL-27528 - release bump related: RHEL-27528 - profiles: added epyc-eda profile resolves: RHEL-27528 - new release - rebased tuned to latest upstream related: RHEL-17119 - renamed intel_uncore plugin to uncore - network-throughput: increased net.ipv4.tcp_rmem default value - new release - rebased tuned to latest upstream related: RHEL-17119 - lower CPU usage by using runtime=0 in profiles using scheduler plugin resolves: RHEL-6869 - new release - rebased tuned to latest upstream resolves: RHEL-17119 - print all arguments of failing commands in error messages - plugin_sysctl: added support for sysctl names with slash - tuned-adm: added support for moving devices between plugin instances - api: added methods for retrieval of plugin instances and devices - plugin_cpu: amd-pstate mentioned instead of just intel_pstate - hotplug: do not report ENOENT errors on device remove - plugin_sysctl: expand variables when reporting overrides - plugin_acpi: new plugin which handles ACPI platform_profile - plugin_bootloader: skip calling rpm-ostree kargs in no-op case - plugin_cpu: support cstate settings of pm_qos_resume_latency_us - scheduler: add option for ignoring IRQs affinity - plugin_intel_uncore: new plugin for uncore setting - new release - api: fixed stop method not to require any parameter resolves: rhbz#2235638 - new release - rebased tuned to latest upstream resolves: rhbz#2182119 - sap-hana: new profile sap-hana-kvm-guest resolves: rhbz#2173740 - serialized SIGHUP handler to prevent possible bootcmdline corruption resolves: rhbz#2215298 - new release - rebased tuned to latest upstream related: rhbz#2133814 - release bump due to broken c8s related: RHEL-27528 - release bump related: RHEL-27528 - profiles: added epyc-eda profile resolves: RHEL-27528 - new release - rebased tuned to latest upstream related: RHEL-17119 - renamed intel_uncore plugin to uncore - network-throughput: increased net.ipv4.tcp_rmem default value - new release - rebased tuned to latest upstream related: RHEL-17119 - lower CPU usage by using runtime=0 in profiles using scheduler plugin resolves: RHEL-6869 - new release - rebased tuned to latest upstream resolves: RHEL-17119 - print all arguments of failing commands in error messages - plugin_sysctl: added support for sysctl names with slash - tuned-adm: added support for moving devices between plugin instances - api: added methods for retrieval of plugin instances and devices - plugin_cpu: amd-pstate mentioned instead of just intel_pstate - hotplug: do not report ENOENT errors on device remove - plugin_sysctl: expand variables when reporting overrides - plugin_acpi: new plugin which handles ACPI platform_profile - plugin_bootloader: skip calling rpm-ostree kargs in no-op case - plugin_cpu: support cstate settings of pm_qos_resume_latency_us - scheduler: add option for ignoring IRQs affinity - plugin_intel_uncore: new plugin for uncore setting - new release - api: fixed stop method not to require any parameter resolves: rhbz#2235638 - new release - rebased tuned to latest upstream resolves: rhbz#2182119 - sap-hana: new profile sap-hana-kvm-guest resolves: rhbz#2173740 - serialized SIGHUP handler to prevent possible bootcmdline corruption resolves: rhbz#2215298 - new release - rebased tuned to latest upstream related: rhbz#2133814 - post RC.1 fixes related: rhbz#2133814 - fixed possible traceback on SIGHUP - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66614 - sap-netweaver: increase vm.max_map_count resolves: RHEL-32124 - release bump due to broken c8s related: RHEL-27528 - release bump related: RHEL-27528 - profiles: added epyc-eda profile resolves: RHEL-27528 - new release - rebased tuned to latest upstream related: RHEL-17119 - renamed intel_uncore plugin to uncore - network-throughput: increased net.ipv4.tcp_rmem default value - new release - rebased tuned to latest upstream related: RHEL-17119 - lower CPU usage by using runtime=0 in profiles using scheduler plugin resolves: RHEL-6869 - new release - rebased tuned to latest upstream resolves: RHEL-17119 - print all arguments of failing commands in error messages - plugin_sysctl: added support for sysctl names with slash - tuned-adm: added support for moving devices between plugin instances - api: added methods for retrieval of plugin instances and devices - plugin_cpu: amd-pstate mentioned instead of just intel_pstate - hotplug: do not report ENOENT errors on device remove - plugin_sysctl: expand variables when reporting overrides - plugin_acpi: new plugin which handles ACPI platform_profile - plugin_bootloader: skip calling rpm-ostree kargs in no-op case - plugin_cpu: support cstate settings of pm_qos_resume_latency_us - scheduler: add option for ignoring IRQs affinity - plugin_intel_uncore: new plugin for uncore setting - new release - api: fixed stop method not to require any parameter resolves: rhbz#2235638 - new release - rebased tuned to latest upstream resolves: rhbz#2182119 - sap-hana: new profile sap-hana-kvm-guest resolves: rhbz#2173740 - serialized SIGHUP handler to prevent possible bootcmdline corruption resolves: rhbz#2215298 - Make hdparm device checks lazy Resolves: RHEL-71457 - Disable the amd.scheduler plug-in instance in the postgresql profile Resolves: RHEL-70470 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66614 - sap-netweaver: increase vm.max_map_count resolves: RHEL-32124 - release bump due to broken c8s related: RHEL-27528 - release bump related: RHEL-27528 - profiles: added epyc-eda profile resolves: RHEL-27528 - new release - rebased tuned to latest upstream related: RHEL-17119 - renamed intel_uncore plugin to uncore - network-throughput: increased net.ipv4.tcp_rmem default value - new release - rebased tuned to latest upstream related: RHEL-17119 - lower CPU usage by using runtime=0 in profiles using scheduler plugin resolves: RHEL-6869 - new release - rebased tuned to latest upstream resolves: RHEL-17119 - print all arguments of failing commands in error messages - plugin_sysctl: added support for sysctl names with slash - tuned-adm: added support for moving devices between plugin instances - api: added methods for retrieval of plugin instances and devices - plugin_cpu: amd-pstate mentioned instead of just intel_pstate - hotplug: do not report ENOENT errors on device remove - plugin_sysctl: expand variables when reporting overrides - plugin_acpi: new plugin which handles ACPI platform_profile - plugin_bootloader: skip calling rpm-ostree kargs in no-op case - plugin_cpu: support cstate settings of pm_qos_resume_latency_us - scheduler: add option for ignoring IRQs affinity - plugin_intel_uncore: new plugin for uncore setting - new release - api: fixed stop method not to require any parameter resolves: rhbz#2235638 - sap-hana forced latency to 70 us Resolves: RHEL-184274 - Make hdparm device checks lazy Resolves: RHEL-71457 - Disable the amd.scheduler plug-in instance in the postgresql profile Resolves: RHEL-70470 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66614 - sap-netweaver: increase vm.max_map_count resolves: RHEL-32124 - release bump due to broken c8s related: RHEL-27528 - release bump related: RHEL-27528 - profiles: added epyc-eda profile resolves: RHEL-27528 - new release - rebased tuned to latest upstream related: RHEL-17119 - renamed intel_uncore plugin to uncore - network-throughput: increased net.ipv4.tcp_rmem default value - new release - rebased tuned to latest upstream related: RHEL-17119 - lower CPU usage by using runtime=0 in profiles using scheduler plugin resolves: RHEL-6869 - new release - rebased tuned to latest upstream resolves: RHEL-17119 - print all arguments of failing commands in error messages - plugin_sysctl: added support for sysctl names with slash - tuned-adm: added support for moving devices between plugin instances - api: added methods for retrieval of plugin instances and devices - plugin_cpu: amd-pstate mentioned instead of just intel_pstate - hotplug: do not report ENOENT errors on device remove - plugin_sysctl: expand variables when reporting overrides - plugin_acpi: new plugin which handles ACPI platform_profile - plugin_bootloader: skip calling rpm-ostree kargs in no-op case - plugin_cpu: support cstate settings of pm_qos_resume_latency_us - scheduler: add option for ignoring IRQs affinity - plugin_intel_uncore: new plugin for uncore setting